UWULEND

DESCRIPTION OF EVENTS

"UwU Lend is a decentralized non-custodial liquidity market protocol where users can participate as depositors, borrowers or LP stakers. Depositors provide liquidity to the market to earn a passive income, while borrowers are able to borrow in an overcollateralized (perpetually) fashion. LP stakers provide liquidity and receive revenue share when staking their LP tokens."

"We generate significant exposure by integrating lending markets, strategies, and vaults within a single platform." "A wide range of supported assets, including major stable coins and exotic tokens." "1-Click Loop your tokens to earn more rewards in UwU and maximize your profits." "Various strategies and vaults to choose from to maximize your returns." "100% of the revenue generated by the platform is distributed amongst platform users."

The protocol "had recently passed a robust security audit".

"No platform can be considered entirely risk free. The potential risks to the UwU Lend platform would be smart contract risks (risk of a bug within the protocol code) and liquidation risk (risk on the collateral liquidation process). Every possible step has been taken to minimize the risks as much as possible - the protocol code has been forked from AAVE V2’s battle tested open source code and it has been audited. Any changes in code and/or new features are tested and audited before release. Additionally, there have been no exploits or security issues since launching in 2022."

"UwuLend[ was] launched by Frog Nation's former CFO Sifu".

"Uwulend’s contract is a fork version of AAVE V2, but they changed the oracle fallback logic to borrow assets at one rate and liquidate them at an artificially inflated rate as seen here.

According to root cause analysis by Nick Franklin, the exploit took advantage of a price discrepancy in UwuLend's oracles.

To manipulate the price, the attacker utilized a flash loan. UwuLend's fallback oracle calculated prices based on the state of several Curve pools.

The attacker could manipulate the pool states by making large trades with the borrowed tokens.

This manipulated the price feed, allowing the attacker to borrow sUSDe at 0.99 but liquidate positions at the inflated 1.03 rate."

Rekt: $19.4 million UwuLend: $23mm

"WETH 481.357407 ($1,704,005.85) WBTC 17.629563 ($1,191,564.34) bLUSD 499,254.38 ($592,614.95) crvUSD 233,819.07 ($233,567.96) sDAI 1,394,055.37 ($1,516,553.58) CRV 25,354,902.10 ($9,381,313.80) DAI 3,522,427.55 ($3,520,853.90) USDT 4,224,277.30 ($4,223,114.99) sUSDe 486,455.22 ($525,371.64)"

"The $19.4 million in drained capital was swiftly moved across two Ethereum addresses in a blitz strike choreographed with criminal precision."

"UwuLend acknowledged the exploit roughly an hour later, pausing the protocol while the team investigated the situation."

"The protocol was paused a little under an hour ago while the team investigates the situation. Please rest assured that we were made aware of the situation immediately and are taking all necessary steps, doing our best here. Stay tuned for further updates."

"Yesterday UwU Lend was the target of an exploit involving a sophisticated attack. The team reacted swiftly and the protocol was paused within minutes. Rates for borrows and deposits have been set to 0% so users’ positions will not be affected by this pause."

"We have made an offer to the hacker and are awaiting a response. The protocol will remained paused until the investigation has concluded."

"With his history of controversies, the question on everyone's mind is, has the former Frog Nation CFO orchestrated yet another masterful deception in the crypto realm?"

UwULend is a lending protocol which allows users to deposit, borrow, or earn rewards for providing liquidity. Unfortunately, it appears that the protocol used a different artificially inflated rate when determining liquidation of assets. This allowed an attacker to use Flash loans to drain the liquidity in a series of at least 3 attacks. The funds for the attack were sources from TornadoCash, and ultimately returned to TornadoCash, except a portion which was liquidated on Curve's Llama Lend.

@peckshield Twitter (Jun 11)
@UwU_Lend Twitter (Jun 11)
@UwU_Lend Twitter (Jun 11)
@RektHQ Twitter (Jun 11)
Rekt - Uwulend - Rekt (Jun 11)
@CyversAlerts Twitter (Jun 11)
UwU Lend (Jun 11)

More case studies

Loopring Official Guardian
2FA Vulnerability

YOLO Games Liquidity
exitPool Check Missing