Sturdy Finance was hacked by an unknown attacker who exploited a reentrancy vulnerability and a faulty price oracle to steal 442 $ETH or about $800,000.
Here's how it happened: 
- The attacker deposits some $ETH into Sturdy Finance's lending pool and receives LP tokens in return.
- The attacker calls the "withdraw" function of Sturdy Finance's smart contract to redeem their LP tokens for ether. However, instead of waiting for the function to finish, the attacker reenters the same function within the same transaction, executing a reentrancy attack.
- By reentering the withdraw function multiple times, the attacker can withdraw more $ETH than they deposited, effectively draining the pool.
- The attacker uses Tornado Cash to hide their identity and the origin of the stolen ETH. 5. The attacker uses Balancer to swap some of the stolen ether for other tokens at an inflated price, taking advantage of Balancer's reliance on price oracles for exchange rates.
- The hacker manipulates the price oracle of Sturdy Finance by reentering the "get_virtual_price" function, which calculates the value of LP tokens based on the total value of the pool.
- By creating inconsistencies between the pool value and the LP token supply, the hacker inflates the value of their LP tokens and trades them for more $ETH on Balancer.
Good to know:
- A reentrancy vulnerability is a type of security flaw that allows an attacker to call a function repeatedly within a single transaction before the original function is completed. This can result in multiple withdrawals of funds from a smart contract without updating the balance.
- A price oracle is a service that provides real-world price data to decentralized applications. However, if the price oracle is not reliable or secure, it can be manipulated by an attacker to create false price signals and trigger undesired actions in the smart contract.
Thank you for reading through, and follow me for more regular post updates.
I’d also appreciate it if you shared this with your friends, who would enjoy reading this.
You can contact me here: Twitter.
You can find my other research & investment thesis here: https://bit.ly/45vA04W
If you find this analysis useful, please consider donating to 0xd95d4b14dcfa941bf916255b3624c0bfb22166c8.
Thank you.
