Wise Lending Succumbs to Flash Loan Hack, Resulting in a DeFi Breach of $464,000
Wise Lending, a well-known Web3 lending application and yield aggregator, has fallen victim to a flash loan attack due to a vulnerability in its contract. This attack resulted in a loss of approximately $464,000, making it one of the first major crypto hacks of 2024 in the DeFi world.
The exploit, which was discovered by blockchain security firm PeckShield, revealed a flaw in Wise Lending’s share accounting logic. This flaw was manipulated through a precision issue, allowing the attacker to drain the platform’s funds.
The attacker used a flash loan attack, a tactic commonly used to manipulate oracle prices. In this case, the attacker targeted a nearly empty market within Wise Lending and artificially inflated the share price. Once this was achieved, the attacker quickly borrowed a significant amount of funds from the lending markets, taking advantage of the manipulated conditions.
Data from Etherscan shows that the attacker made off with $9,000 worth of USD Coin (USDC), $2,000 worth of Tether (USDT), $5,000 worth of Dai (DAI), 18.51 Wrapped Ether (WETH) valued at $47,694, and various tokens linked to Pendle Finance. Additionally, the attacker used the flash loan to borrow 1,110 Lido Staked Ether (stETH) tokens from the Aave (AAVE) lending protocol, totaling around $2.9 million.
Initial reports suggested that a new derivative token from Pendle Finance was the cause of the attack. However, some blockchain researchers have suggested a potential link to a 7% price swing between stETH and ETH within a specific pool, possibly triggered by an AAVE v2 stETH flash loan.
In response to the attack, Wise Lending has implemented preventive measures, and the wider crypto community is closely monitoring developments and potential security enhancements following this breach early in 2024.
This flash loan exploit by Wise Lending serves as a reminder of the challenges in securing DeFi platforms. It highlights the importance of robust security measures and vigilance in the ever-evolving crypto ecosystem.