RHO MARKETS

DESCRIPTION OF EVENTS

"Rho Market is the liquidity layer build on Scroll, based an overcollateralized lending model, we also bring & leverage LRT Assets yield in Scroll." "Rho Market primarily offers liquidity for users, including LRT assets such as pufETH, ezETH, as well as mainstream - ETH & BTC." "RHO, is poised to become a central liquidity layer, supporting ongoing projects and emerging Layer 3 solutions on the Scroll platform."

"Rho is more than just a liquidity hub, it's a harbinger of financial revolution" "The protocol employs robust security Modules to protect user funds. By prioritizing security, the Rho Market community can confidently lend and borrow digital assets." "Any changes require on-chain governance proposals. This ensures alignment with community interests and eliminates single points of failure." "LRT assets lending is supported. Users can stake $RATE to earn higher yields. Through multiple LSD/LRT yield layers, the staking APR can reach up to 50%." "Through integration with the Sign Protocol and Plaid, Rho Market facilitates lending, repayment, and liquidation processes with funds directly from USD bank accounts."

"On July 19, 2024, shortly after updating the smart contract for a new market launch, Rho Markets identified that the price oracles for ETH and BTC were providing contradictory price feeds due to a misconfiguration in the deployment script. This issue resulted in the prices of BTC and ETH being reversed, creating arbitrage opportunities for MEV bots. Due to the incorrect oracle pricing, assets including USDC, USDT, wstETH, STONE, and wrsETH were borrowed up to their borrowing caps. The estimated total amount affected is approximately $7.6 million. The incidence took place on Scroll, impacting assets such as USDC, USDT, ETH, wstETH, and others. The MEV bot borrowed approximately $7.6 million worth of assets using a minimal amount of collateral in ETH."

"The vulnerability arose from a misconfiguration that allowed ETH suppliers to mint rETH at the BTC oracle price and use it as collateral within the Rho Markets protocol, resulting in a 20X increase in the actual value of ETH. This issue occurred due to the erroneous configuration of the ETH oracle price feed to the BTC price feed. Normally, such settings are validated before any changes are implemented. However, due to a human error in overseeing the deployment process, this validation check was missed in the case of the oracle price."

"Upon detecting the security vulnerability, our team immediately activated the incident response plan and successfully disabled all vulnerable components on the protocol, thereby containing the threat. With the assistance of security professionals from SEAL 911, we promptly communicated with the MEV wallet address and received a positive response. Within the next six hours, 100% of the funds were returned from the MEV address."

"Hello RHO team, our MEV bot have profited from your price oracle misconfiguration. We understand that the funds belong to users and are willing to fully return. But first we would like you to admit that it was not an exploit or a hack, but a misconfiguration on your end. Also, please provide what are you going to do to prevent it from happening again."

"Moving forward, we have outlined the following three meticulously planned steps in response to the recent events:

1. Thoroughly identify the accounts that were actively supplying funds during the period when the oracle encountered issues.

2. Methodically replenish the funds into the USDC/USDT/wstETH pools, ensuring a seamless restoration of the affected balances.

3. Methodically reinstate the borrowing and transfer functionalities, adhering to stringent security protocols throughout the process.

Rest assured, our team is diligently executing these steps to reinstate normalcy, reinforce the integrity of our system, and safeguard the interests of our valued users."

"Our security measures have been functioning as intended. The incident occurred due to a human error in managing the deployment process. To avoid similar issues in the future, we are undertaking a thorough review and overhaul of our deployment procedures."

"Rho Markets is dedicated to ensuring the security of our protocol and user assets. Beyond our existing multi-step deployment review process, we are going to implement additional security policies and measures to prevent future incidents, including:

Thorough testing on Tenderly Fork: We will test any upgrades on a Tenderly fork if we need to update the price oracles or other changes to the protocol. Meticulous Review Process: We will review each step meticulously to verify configuration setups, price oracles, and other relevant settings. Clean Deployment Environment: We will ensure our deployment environment is clean by initiating new environments for each deployment and upgrade Enhanced Verification: We will work with security teams to verify all deployments are correct before mainnet deployment. Bounty Programs through Immunefi"

Rho Markets is a protocol allowing users to lend out specific blockchain assets such as pufETH, ezETH, as well as mainstream assets including ethereum and bitcoin. On July 19th, 2024, there was a confguration issue where the team mixed up bitcoin and ethereum pricing in their oracle, which allowed a MEV bot to make a considerable profit due to the issue. The funds were ultimately returned and redistributed to users, with the cooperation of the bot owner.

Rekt - Rho Market - Rekt (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
Rho Markets Security Incident Report (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@RhoMarketsHQ Twitter (Aug 7)
@Scroll_ZKP Twitter (Aug 7)
Scroll Transaction Hash (Txhash) Details | Scrollscan  (Aug 7)
DeBank | The Real User Based Web3 Community (Aug 7)
Rho Markets (Jun 10)
https://www.rhomarkets.xyz/ (Jun 10)
Scroll Transactions Information | Scrollscan  (Aug 7)
@zachxbt Twitter (Aug 7)
DeBank | The Real User Based Web3 Community (Aug 7)
@CJCJCJCJ_ Twitter (Aug 7)
Scroll Transaction Hash (Txhash) Details | Scrollscan  (Aug 7)

More case studies

WazirX Multi-sig
Wallet Breach

ETHTrustFund Silent
Developer Rug Pull