FluidTokens Don Pay Back Lenders After Cardano Oracle Feed Exploit

FluidTokens don reimburse lenders wey the attack for im Cardano lending protocol affect, and dem don block the smart contract wey the attacker use take commot funds from isolated liquidity pools. The team talk say the incident come from oracle feed wahala, no be from any vulnerability for the protocol validators. Dem also report say collateral and other token positions no move at all.

The Attack Na Only One Lending Market E Touch

Based on on-chain analysis wey dey available, the attack run from about 20:59 UTC on September 29 reach 00:48 UTC on September 30. One wallet run 57 transactions wey target isolated pools wey accept the project token as collateral.

Some of the transactions wey dem analyze use one raw unit of FLDT, equal to 0.000001 token, to open loans wey big pass normal. This pattern suggest say fit be unit mismatch for the oracle data, as if dem use the price of full token for the smallest accounting unit.

If na so, the smart contracts fit still enforce their loan to value rules correctly but with wrong price input. FluidTokens officially confirm only say the incident involve oracle feed issue. The unit mismatch still remain independent analysis finding until the team release their post mortem.

Dem never officially disclose the final amount wey commot. Decoded transactions show at least about 67,000 ADA, wey put the outflow wey dem don identify so far for tens of thousands units of Cardano native asset.

Isolated Pools Help Limit the Impact

FluidTokens na noncustodial lending protocol wey launch for Cardano for 2022. Lenders fit create liquidity pools, choose the collateral dem go accept and define interest rates, loan duration and liquidation conditions. Borrowers fit access pools wey match the terms of the assets dem provide as collateral.

Dynamic pools dey use oracle data to calculate collateral values and available borrowing capacity. Na why the technical investigation now focus on the data wey dem supply to the lending contracts, no be on the validator rules.

Each FluidTokens pool get im own separate liquidity and collateral conditions. This structure stop the wrong price input from spreading go other lending markets.

The team talk say nobody touch collateral or other token positions. Funds wey dey inside the paused contracts no dey accessible to both the FluidTokens team and the attacker.

This incident come after the September 13 exploit of Splash StableSwap pool, but the two cases get different reported causes. Splash talk say missing checks for validator cause their own, while FluidTokens attribute their own to external price data wey the lending system dey use.

FluidTokens Go Reopen Lending on October 1

FluidTokens go reopen im lending protocol on October 1 at 16:30 UTC. Dem don reimburse affected lenders before the restart, and the team talk say dem reverse engineer the attacker smart contract and don permanently block the transaction pattern wey the attack use.

Invariant0, the Cardano security team wey people formerly know as Vacuumlabs Auditing, help for the response. FluidTokens publicly thank the auditors and community members wey help trace the transactions and analyze the exploit.

Dem never publish the exact source of the wrong oracle value, the final amount wey commot and the extra safeguards wey dem add before reopening. FluidTokens talk say all those details go dey inside their full incident analysis.

When lending resume, the affected lenders go don get their money complete, the market path wey dem exploit go remain blocked and the paused positions go return without their collateral moving. Wetin remain to disclose na the technical path wey allow the wrong oracle value to authorize the loans.