ONYX PROTOCOL

DESCRIPTION OF EVENTS

"The Backbone of Decentralised Web3 Protocols"

"Onyx Protocol is an algorithmic money market designed to bring secure and trustless credit and lending to users on Ethereum Network.

Onyx enables investors to lend and/or borrow cryptocurrencies, by pledging the platform an over-collateralized amount of cryptocurrency. Onyx does this by utilizing money markets, which are pools of assets with algorithmically derived interest rates, based on the supply and demand of each asset.

Users who choose to supply liquidity to Onyx earn compounded interest as rewards for supplying their assets to the protocol. When supplying assets, users are also given the ability to mint stable-coins, or borrow other assets against their supplied assets. Once a user has supplied assets to Onyx, the user can then borrow assets or mint stable-coins, by over-collateralizing and paying interest on the amount borrowed.

Loans from the Onyx protocol do not have monthly payments, late fees, and can be paid off at any time. Onyx is able to do this without ever requiring a credit check, with near immediate origination, using smart contracts that provide an automated, and absolutely transparent system for investment and profit distribution.

Onyx also provides loans for CryptoPunks and BAYC. NFT holders can leverage their idle NFTs to obtain loans and earn extra yield."

"The vulnerability stems from a flaw in the asset’s exchange rate calculation when there’s low liquidity in a certain market. The attacker manipulated the exchange rate by minting and redeeming Onyx ETH (oETH) 56 times."

"The exploit started with a 2K ETH flash loan from Balancer. The attacker deposited 1,999.5 ETH into the oEther contract (oETH market) while depositing 0.5 ETH into another malicious contract (0xAE7d68) created in the same transaction.

This contract was used to mint and redeem very small amounts of oETH (as little as 0.00000001 oETH), manipulating the exchange rate to exploit the system."

"ALERT! Our system has detected suspicious transaction involving @OnyxDAO on #ETH chain!

Total loss is around $3.2M. Most of the loss are in $VUSD. Attacker currently holds 521 $ETH $1.36M. Rest of the digital assets are not swapped yet!"

"Onyx Protocol is aware of unusual activity on our platform and is currently reviewing third party post mortem examination data while conducting our own investigation.

We will announce further details in due course"

"Another Compound v2 fork that just can't catch a break, @OnyxDAO, has been exploited again."

This time, the damage tally stands at a cool $3.8 million, siphoned off by the same vulnerability that bit them late last year."

"The attacker has already swapped all the stolen VUSD to ETH using CoW Protocol and Uniswap. In 12 transactions, they swapped 3.8M VUSD but only received 570 ETH ($1.5M) due to high slippage in the liquidity pools."

"Onyx DAO is offering a 20% bounty for the recovery of the exploited funds. We will also consider funds returned from the hacker as a bounty and request 80% back. After 7 days, we will send the information from third parties regarding the identity of the hackers to authorities."

Onyx Protocol is an algorithmic money market designed to bring secure and trustless credit and lending to users on Ethereum Network. On September 26th, 2024, they were once again exploited by a low liquidity market, with an attacker walking off with $3.8m worth of funds. At present, they have offered the attacker a 20% bounty and the final outcome is unclear.

@RektHQ Twitter (Sep 27)
@OnyxDAO Twitter (Sep 27)
@CyversAlerts Twitter (Sep 27)
@hackenclub Twitter (Sep 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 27)
@peckshield Twitter (Sep 27)
The Backbone of Decentralised Web3 Protocols (Sep 27)
Onyx Documentation | Onyx Protocol (Sep 27)
@OnyxDAO Twitter (Sep 27)
@peckshield Twitter (Sep 27)
@peckshield Twitter (Sep 27)
@hackenclub Twitter (Sep 27)

More case studies

Truflation TRUF
Token Malware Attack

Bedrock SigmaSupplier
uniBTC Forging Exploit