INVERSE FINANCE

DESCRIPTION OF EVENTS

"DOLA Borrowing Rights replace interest rates with a fixed fee that can earn you more."

"Inverse Finance is a decentralized autonomous organization that develops and manages the FiRM fixed rate lending protocol and DOLA, a debt-backed decentralized stablecoin. Originally founded by Nour Haridy in late 2020, the protocol is now governed by Inverse Finance DAO, a collective of crypto enthusiasts. Our code base is open source and maintained by the community."

"Ethereum-based lending protocol, Inverse Finance, has witnessed its second hack this year. The DeFi lender was exploited via price oracle manipulation through which, the attacker made a profit of $1.26 million in BTC and USDT."

"[T]he hacker misused the balances of assets in the pool to directly calculate the LP token price, further altering the reserves in the pool and facilitating a flash loan attack. The attacker quickly sold the stolen funds via Uniswap, further putting them through Tornado cash.

The protocol’s official Twitter handle acknowledged the exploit and announced that they are temporarily halting the borrowing services because of the hack. Inverse Finance said its over-collateralized stablecoin DOLA was removed from its money market, Frontier. The DeFi platform tweeted — “We are investigating the incident however no user funds were taken or were at risk. We are investigating and will provide more details soon”."

"@InverseFinance was exploited leading to the gain of ~$1.26M for the hacker (The protocol loss may be larger)."

"The hack is made possible due to the price oracle manipulation, which misuses the balances of assets in the pool to directly calculate the LP token price. It is greatly facilitated by the flashloan to skew the reserves in the pool."

"Inverse has temporarily paused borrows following an incident this morning where DOLA was removed from our money market, Frontier. We are investigating the incident however no user funds were taken or were at risk. We are investigating and will provide more details soon."

"The initial fund (1 ETH) to launch the hack is withdrawn from @TornadoCash. Currently 68 ETHs of the illicit gains still stay in the hacker’s account and 1000 ETHs have been deposited to @TornadoCash"

Explore This Case Further On Our Wiki

Inverse Finance, a decentralized lending protocol, experienced its second hack of the year through price oracle manipulation. The attacker made a profit of $1.26 million in BTC and USDT by exploiting imbalances in assets to calculate LP token prices. The attacker used a flash loan to manipulate pool reserves and quickly sold the stolen funds via Uniswap, laundering them through Tornado Cash. The protocol temporarily halted borrowing services and removed its stablecoin DOLA from its money market, reassuring users that no funds were taken or at risk.

@VauldOfficial Twitter (Oct 19)
DeFi Hack: Inverse Finance Exploited For The Second Time This Year   - Vauld Insights (Aug 25)
@peckshield Twitter (Aug 25)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Aug 25)
@InverseFinance Twitter (Aug 25)
Inverse Finance (Aug 25)
Introduction - Inverse Finance (Aug 25)

More case studies

Celsius Platform
Withdrawals Paused

Babel Finance
Halts Withdrawals