ONYX PROTOCOL

DESCRIPTION OF EVENTS

"The Backbone of Decentralised Web3 Protocols"

"Onyx Protocol is an algorithmic money market designed to bring secure and trustless credit and lending to users on Ethereum Network.

Onyx enables investors to lend and/or borrow cryptocurrencies, by pledging the platform an over-collateralized amount of cryptocurrency. Onyx does this by utilizing money markets, which are pools of assets with algorithmically derived interest rates, based on the supply and demand of each asset.

Users who choose to supply liquidity to Onyx earn compounded interest as rewards for supplying their assets to the protocol. When supplying assets, users are also given the ability to mint stable-coins, or borrow other assets against their supplied assets. Once a user has supplied assets to Onyx, the user can then borrow assets or mint stable-coins, by over-collateralizing and paying interest on the amount borrowed.

Loans from the Onyx protocol do not have monthly payments, late fees, and can be paid off at any time. Onyx is able to do this without ever requiring a credit check, with near immediate origination, using smart contracts that provide an automated, and absolutely transparent system for investment and profit distribution.

Onyx also provides loans for CryptoPunks and BAYC. NFT holders can leverage their idle NFTs to obtain loans and earn extra yield."

"In Onyx’ case, governance had recently voted through Proposal 22 to add a lending market for memecoin PEPE to the protocol." "Onyx Protocol Deployment: Onyx Protocol introduced the "oPEPE" market with no initial liquidity."

"many of the findings during their audit were acknowledged instead of fixed. There is no point in reaching out to security researchers if you do not listen to their advice."

"The exact same attack vector has hit two other forks, Hundred Finance and Midas Capital (themselves both repeat leaderboard entrants), already this year, tipping the total lost to this bug over the $10M mark."

"Onyx Protocol Deployment: Onyx Protocol introduced the "oPEPE" market with no initial liquidity just five days before the exploit."

"Rounding Issue Exploited: Attackers leveraged a known rounding issue from the CompoundV2 fork, affecting how numbers are handled in oPEPE's smart contracts."

"Donation and Borrowing: Attackers initiated the exploit by making a small donation to oPEPE, enabling them to borrow substantial assets from liquid markets."

"Exploitative Redemption: The critical step was the attackers exploiting the rounding issue when redeeming borrowed assets, resulting in significant profit."

"Similar to Past Hack: This technique resembled the one used in the Hundred Finance hack, suggesting a shared vulnerability in the CompoundV2 fork."

"In the process of the Onyx Protocol exploit, the attacker executed a series of complex swaps to obfuscate their actions and facilitate the theft of funds."

"Compound fork @OnyxProtocol lost $2.1M on Tuesday, to a high-profile, well-known vulnerability. Many protocols have fallen victim to repeated vulnerabilities so far this year. Are devs paying attention?"

"The @OnyxProtocol experienced an exploit. Fund loss is 1,163.53 ETH ~$2.1mln. We are aware of the situation, closed the vulnerability, and working on the consequences with our partners."

Onyx Protocol is an algorithmic money market designed to bring secure and trustless credit and lending to users on Ethereum Network. On November 1st, 2023, they introduced a new market for the PEPE meme coin. Unfortunately, this market lacked liquidity, and a rounding error in the liquidity smart contract enabled an attacker to exploit and walk off with $2.1m USD. Plans were ultimately made to reimburse users via a third party acquisition of the platform.

Rekt - Onyx Protocol - REKT (Sep 27)
The Backbone of Decentralised Web3 Protocols (Sep 27)
Onyx Documentation | Onyx Protocol (Sep 27)
@RektHQ Twitter (Sep 27)
@peckshield Twitter (Sep 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 27)
@al_onyxprotocol Twitter (Sep 27)
@KeyBoxAI Twitter (Sep 27)
@Securrtech Twitter (Sep 27)
@al_onyxprotocol Twitter (Sep 27)
Recovery Proposal 3 of 3: Reduce inflation and launch the v2 Onyx Money Market Protocol - Updates - Onyx Community (Sep 27)
@PeckShieldAlert Twitter (Sep 27)
@hackenclub Twitter (Sep 27)
@Phalcon_xyz Twitter (Sep 27)
@al_onyxprotocol Twitter (Sep 27)
@PeckShieldAlert Twitter (Sep 27)
@peckshield Twitter (Sep 27)
@al_onyxprotocol Twitter (Sep 27)
@al_onyxprotocol Twitter (Sep 27)
@CyversAlerts Twitter (Sep 27)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Sep 27)
@ddimitrovv22 Twitter (Sep 27)
@freedomonfire Twitter (Sep 27)
@VeridiseInc Twitter (Sep 27)
@HudsonEstell1 Twitter (Sep 27)
@_true_mr_robot Twitter (Sep 27)
@Coin_CRUXX Twitter (Sep 27)
@MetaTrustAlert Twitter (Sep 27)
@lazinwest Twitter (Sep 27)
@web3_watchdog Twitter (Sep 27)
@chngvr52 Twitter (Sep 27)
@BeingSatoshi Twitter (Sep 27)
@alphador_ai Twitter (Sep 27)
@Ayman_Tweets Twitter (Sep 27)
@The_CryptoPost Twitter (Sep 27)
@Haiderali_eth Twitter (Sep 27)
@n3120_t Twitter (Sep 27)
@kexleyBeefy Twitter (Sep 27)
@ImmuneBytes Twitter (Sep 27)
@ramrajtweetz Twitter (Sep 27)
@BtcNewsBiz Twitter (Sep 27)
@CryptoPost_ESP Twitter (Sep 27)
@0x_homer Twitter (Sep 27)
@OKLink Twitter (Sep 27)
@hackenclub Twitter (Sep 27)
@De_FiSecurity Twitter (Sep 27)
@veriti_global Twitter (Sep 27)
@CyversAlerts Twitter (Sep 27)
@MetaTrustAlert Twitter (Sep 27)
@blockjournal Twitter (Sep 27)
@AuditaSecurity Twitter (Sep 27)
@leshka_eth Twitter (Sep 27)
@cassyjnr Twitter (Sep 27)
@hake_stake Twitter (Sep 27)
@CyberSec84 Twitter (Sep 27)
@DanielSlothx Twitter (Sep 27)
@CryptoGeek1987 Twitter (Sep 27)
@web3_watchdog Twitter (Sep 27)
@Cyberscope_io Twitter (Sep 27)
@quillaudits_ai Twitter (Sep 27)
@d3ploy_ Twitter (Sep 27)
@hackenclub Twitter (Sep 27)
@johnmorganFL Twitter (Sep 27)
@InspexCo Twitter (Sep 27)
@web3_watchdog Twitter (Sep 27)
@bhumharit Twitter (Sep 27)
@CryptoHunterQ Twitter (Sep 27)
@oakchain_ Twitter (Sep 27)
@CryptoRu_off Twitter (Sep 27)
@CyversAlerts Twitter (Sep 27)
@EthPub Twitter (Sep 27)
@InspexCo Twitter (Sep 27)
@Bitrace_team Twitter (Sep 27)
@protectmywallet Twitter (Sep 27)
@JuratNetwork Twitter (Sep 27)
@TechRightio Twitter (Sep 27)
@web3_watchdog Twitter (Sep 27)
@cryptotalemedia Twitter (Sep 27)
@BTCTN Twitter (Sep 27)
@hapi_labs Twitter (Sep 27)

More case studies

Wall Street Memes
Discord Hack

Wall Street Memes Staking
Contract Exploited