Ola Finance Exploit

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Ola Finance

Ola Finance offers a service which allows others to launch decentralized lending platforms. There was a re-entrancy exploit in the smart contract which was exploited by an attacker to take a significant amount of funds. The attacker was unable to be reached to negotiate the return of the funds, however the Ola Finance developers have agreed to put in place a compensation scheme for those affected users.

About Ola Finance

Ola Finance is a platform that enables users to create customized lending and borrowing instances similar to Compound. Ola Finance calls itself "[a] decentralized protocol for programmable lending" and describes itself as a Lending-as-a-Service platform that enables the creation of personalized lending networks with adjustable parameters such as collateralization ratio, interest rate model, and liquidation mechanism. Unlike platforms like Compound or Aave, Ola is a technology provider that allows others to build their own lending networks with customized governance and control. It addresses the limitations of traditional banking systems and the existing DeFi lending networks by providing more flexibility and customization options. Ola aims to establish an inclusive lending protocol within DeFi, where assets can be listed without the need for complex governance schemes or extensive requirements. The Ola platform aims to provide support and infrastructure for all individual networks while also ensuring global community governance.

The platform's primary objective is to expand the range of tokens that provide lending and borrowing services while managing the risk levels for users. Ola achieves this by allowing multiple instances to coexist, each with its unique risk profile. The Ola Finance protocol supports various types of assets, ranging from governance tokens to stablecoins and exotic receipt tokens. The risk isolation feature of Ola ensures that each lending network has its own risk profile, safeguarding assets in other networks from theft or failure. Ola targets creators who can launch lending networks for their communities, as well as lenders and borrowers who benefit from a standardized UI and access to multiple lending networks across different blockchains. The advantages of using Ola include a wider selection of tokens, reduced risk through independent lending networks, competitive rates for borrowers and lenders, and a seamless user experience. Ola currently operates on multiple blockchains and can build lending networks on any EVM-compatible blockchain.

Ola Finance aims to enhance accessibility and flexibility in the lending and borrowing space by offering a diverse range of tokens and risk options to its community. Ola Finance aims to solve the complexity and fragmentation of DeFi lending, with different protocols and user experiences across various platforms by providing a unified solution. Ola Finance fosters competition among lending networks, leading to better rates for both borrowers and lenders. With the ability for anyone to deploy their own lending network based on their terms, users naturally gravitate towards the networks offering the most attractive rates. This results in borrowers paying lower interest rates while suppliers earn higher returns, as the lending networks themselves take a smaller portion of the fees.

Currently, Ola has lending networks deployed on various blockchains, including Binance Smart Chain, Ethereum, Polygon, Avalanche, and Fantom, with plans to expand to more chains in the future. They have the capability to build lending networks on any blockchain that is compatible with the Ethereum Virtual Machine (EVM), whether it's a Layer 1, sidechain, or Layer 2 roll-up.

Integration/Collaboration With Fuse Network

Fuse Network launched the Fuse Lending Network, a platform focused on making payments and DeFi accessible. This DeFi protocol allows users to lend and borrow supported currencies such as FUSE, WETH, WBTC, and USDC. One major difference between Fuse Lending Network and other protocols like Compound is the ability to create isolated instances of lending networks. This approach enables the inclusion of smaller-cap assets and allows for more flexibility in adding different tokens. To support less liquid tokens, Ola Finance, the platform behind Fuse Lending Network, utilizes a "protector bot" to detect price anomalies and provide liquidity. The lending protocol will be the first of many instances created based on demand, allowing for a wider range of tokens to be used as collateral. Users can supply assets to the lending pool and earn interest through interest-bearing assets called "oTokens." Borrowers need to deposit sufficient collateral in one of the supported assets to borrow, with specific collateral factors and liquidation factors in place. There will be a cap on the enabled collateral for certain assets, and borrowers can repay their loans at any time. The launch of the Fuse Lending Network was set for May 26th, 2021, and an AMA session will be conducted to address community questions and provide more details about the platform. The initial launch will support assets such as FUSE, Wrapped Ether (WETH), Wrapped Bitcoin (WBTC), and USDC. In the future, other payment communities on Fuse can utilize Ola to launch their own lending networks and promote the adoption of their tokens or services.

The Reality

Audits Prior To Incident

Include the history of Ola Finance audits. TBD

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

Ola Finance suffered an exploit that allowed hackers to grab between $3.6m and $4.67m worth of cryptocurrency from the platform.

Key Event Timeline - Ola Finance Exploit

Date	Event	Description
May 5th, 2021 6:53:40 AM MDT		Ola Finance is a platform that allows for the creation of custom decentralized lending networks. It addresses the limitations of traditional banking systems and the existing DeFi lending networks by providing more flexibility and customization options. While major lending networks like Compound and Aave have seen success in the DeFi industry, they are often limited to a small number of tokens and do not cater to specific communities or user needs. Ola Finance enables communities to create their own lending networks with adjustable parameters such as collateralization ratio, interest rate model, and liquidation mechanism. The Ola platform will provide support and infrastructure for these individual networks while also ensuring global community governance. Fuse, a platform focused on making payments and DeFi accessible, will integrate Ola Finance to create the first native decentralized lending network on its platform. The initial launch will support assets such as FUSE, Wrapped Ether (WETH), Wrapped Bitcoin (WBTC), and USDC. In the future, other payment communities on Fuse can utilize Ola to launch their own lending networks and promote the adoption of their tokens or services.
May 25th, 2021 11:13:00 AM MDT	Fuse.io Launch Announced	Fuse Network announced the launch of the Fuse Lending Network. This DeFi protocol allows users to lend and borrow supported currencies such as FUSE, WETH, WBTC, and USDC. One major difference between Fuse Lending Network and other protocols like Compound is the ability to create isolated instances of lending networks. This approach enables the inclusion of smaller-cap assets and allows for more flexibility in adding different tokens. To support less liquid tokens, Ola Finance, the platform behind Fuse Lending Network, utilizes a "protector bot" to detect price anomalies and provide liquidity. The lending protocol will be the first of many instances created based on demand, allowing for a wider range of tokens to be used as collateral. Users can supply assets to the lending pool and earn interest through interest-bearing assets called "oTokens." Borrowers need to deposit sufficient collateral in one of the supported assets to borrow, with specific collateral factors and liquidation factors in place. There will be a cap on the enabled collateral for certain assets, and borrowers can repay their loans at any time. The launch of the Fuse Lending Network was set for May 26th, 2021, and an AMA session will be conducted to address community questions and provide more details about the platform.
March 30th, 2022 8:10:40 PM MDT	Hacking Transaction	One of the transactions involved in the attack occurred on the blockchain. TBD more blockchain analysis.
March 31st, 2022 1:24:00 AM MDT	Investigation Announced on Twitter	The Ola Finance team announces they are starting an investigation.
March 31st, 2022 1:25:00 AM MDT	PeckShield Posts Blockchain Analysis of Attack	Blockchain research firm PeckShield posts an analysis of the attack on Twitter.
March 31st, 2022 6:10:00 AM MDT	Initial Tweet Announces Official Report	We will soon be publishing an official report detailing the exploit that occurred on the @voltfinance Lending Network and the plan for recourse.
March 31st, 2022 3:44:00 PM MDT	Solidarity Tweet Posted	Ola Finance posts a tweet to reassure the community that they remain intent on compensating users. TBD expand on more.
March 31st, 2022 3:45:27 PM MDT	PostMortem Published	A postmortem is published on the Ola Finance Medium page.
April 3rd, 2022 2:16:08 PM MDT	Announcing Security Revamps	The Ola Finance team announces security revamps in a newly published Medium post.
April 8th, 2022 1:12:00 AM MDT	Transparency Report Published	Ola Finance publishes their "Transparency Report, Compensation Plan and Future Steps".
May 1st, 2022 3:30:00 PM MDT	Proactive To Other Exploits	Ola Finance publishes a tweet to "assure everyone that the Lending Networks built on Ola Finance are SAFE and not susceptible to the recent [and unrelated] Rari Fuse exploit".

Technical Details

TBD Need to complete this section and properly incorporate information below.

"The exploit occurred at around 2am UTC on 31st March. The value stolen summed up to ~$4.67M at the time of the attack in ETH, BTC and FUSE prices: 216,964.18 USDC, 507,216.68 BUSD, 200,000.00 fUSD, 550.45 WETH, 26.25 WBTC, 1,240,000.00 FUSE." "At approximately 5am on 31st March (UTC +3), The lending network on Fuse blockchain was exploited for 216,964.18 USDC, 507,216.68 BUSD, 200,000.00 fUSD, 550.45 WETH, 26.25 WBTC, and 1,240,000.00 FUSE. The value stolen sums up to ~$4.67M in today’s ETH, BTC and FUSE prices."

"The initial funds to launch the hack are withdrawn from @TornadoCash and tunneled to Fuse network via Fuse Bridge."

"The hack is made possible due to the incompatibility between Compound fork and ERC677/ERC777-based tokens, which have the built-in callback functions misused to allow for reentrancy to drain the lending pool." "The attack used a reentrancy vulnerability in the ERC677 token standard. Analyzing one of the heist transactions, we found the following series of events:"

"(1) Attacker transferred WETH from C1 to C2."

"(2) Attacker minted oWETH to C2 (transferring WETH to the oWETH contract)."

"(3) Attacker borrowed XXX token to C2 from the oXXX contract."

"(4) Since XXX is an ERC677, a callback function was called on C2 during the transfer of XXX from oXXX to C2. In this callback, the attacker transferred the oWETH from C2 to C1. This was possible because the state that updates C2’s borrow balance (and would prevent the transfer of the oWETH) was not updated yet."

"(5) Since C1 had no borrow balance it could redeem the oWETH back to WETH."

"(6) The attacker ended up with both the WETH used as collateral to borrow the XXX token and the XXX token they borrowed."

"(7) To steal fUSD and FUSE (which are not ERC677), the attacker used the WETH they had already stolen to mint oWETH and borrow all available fUSD and FUSE tokens. Then, they took advantage of the same reentrancy vulnerability to retrieve back the WETH they had just deposited and used as collateral to borrow the fUSD and FUSE."

"In the first heist transaction, the attacker took a 515 WETH flash loan from the WETH-WBTC pair on Voltage.Finance to fund the attack. In later transactions, the attacker avoided a flash loan by using the funds that had already been stolen."

"The gains [were] tunneled via Fuse Bridge and currently funds still stay in the hacker’s account."

PeckShield Technical Analysis

PeckShield performed an analysis of the attack and shared the results on Twitter.

1/ The @ola_finance is exploited in a flurry of txs, leading to the gain of ~$3.6M for the hacker (the protocol loss is larger). Here is an example hack tx: https://explorer.fuse.io/tx/0x1b3e06b6b310886dfd90a5df8ddbaf515750eda7126cf5f69874e92761b1dc90

2/ To illustrate, we use the above example hack tx and show the key steps below

3/ The hack is made possible due to the incompatibility  between Compound fork and ERC677/ERC777-based tokens, which have the built-in callback functions misused to allow for reentrancy to drain the lending pool.

4/ The initial funds to launch the hack are withdrawn from @TornadoCash and tunneled to Fuse network via Fuse Bridge. The gains are tunneled via Fuse Bridge and currently funds still stay in the hacker’s account (0xbcdb800d77ccaac6597830b026d6af78a1118f42).

Total Amount Lost

The exploit only affected the Fuse Network liquidity pools.

The total amount lost has been estimated at $4,670,000 USD. TBD

$3.6m - https://ca.style.yahoo.com/trezor-issues-data-breach-warning-160241180.html

"The exploit occurred at around 2am UTC on 31st March. The value stolen summed up to ~$4.67M at the time of the attack in ETH, BTC and FUSE prices: 216,964.18 USDC, 507,216.68 BUSD, 200,000.00 fUSD, 550.45 WETH, 26.25 WBTC, 1,240,000.00 FUSE." "At approximately 5am on 31st March (UTC +3), The lending network on Fuse blockchain was exploited for 216,964.18 USDC, 507,216.68 BUSD, 200,000.00 fUSD, 550.45 WETH, 26.25 WBTC, and 1,240,000.00 FUSE. The value stolen sums up to ~$4.67M in today’s ETH, BTC and FUSE prices."

Immediate Reactions

Ola Finance announced an initial investigation of the incident on Twitter. They followed up with further tweets making clear that they intended to reimburse affected users. Multiple security entities including Peckshield provided additional technical details of the exploit as it took place.

Initial Twitter Update Posted

Ola Finance said on Twitter at the time: "We are investigating an exploit that took place on the @Fuse_network LeN. All other lending networks remain unaffected, and we have pre-emptively paused borrowing capabilities to mitigate any risk."

"[A] few mechanisms were quickly implemented to control the situation. First, we paused borrowing activity on all our lending networks until we were 100% certain that this vulnerability doesn’t apply to any of them. In addition, we paused the minting of new tokens (i.e. supplying tokens) to the lending network to safeguard users seeking high APYs without awareness of the situation. Finally, we changed the lending network’s interest rate models to reflect 0% APY for borrowers and set all RainMaker speeds to 0; this way, borrowers would not pay inflated interest rates as a result of the attack."

"In this joint blog post we aim to provide a complete overview of events concerning the very unfortunate exploit which took place on 31st March leading to the theft of over $4 million and plans to make amends to those affected."

"As of writing, the stolen funds are still being held by the attacker on Ethereum and BNB Chain. Legal authorities have been alerted and we are working to prohibit the attacker from making any legal use of funds."

"An attempt was made to establish contact with the hacker via data input on an Ethereum transaction on Thursday 31st March following the exploit. As of yet we have received no communication from him/her."

Ola Finance Solidarity Tweet

Ola Finance posted in the aftermath of the attack. TBD expand.

Standing together, @ola_finance and @voltfinance remain united in our efforts to compensate users suffering from the latest exploit.

Ultimate Outcome

Ola Finance shared some reflections about the exploit, and that it highlighted the "importance of taking a step back to consider risk during periods of rapid growth". Ola Finance ultimately completed a reimbursement program for users affected by the exploit.

"Important lessons have been learned about the importance of taking a step back to consider risk during periods of rapid growth. We are convinced that the entire, collective community will come out of this stronger than ever. We’re more galvanized than ever in our mission to take DeFi mainstream. We also realize that, whilst unfortunate events like this can occur when battle-testing cutting-edge technology, making user safety a number one priority is crucial to the industry’s long-term success."

"We are providing our partners the ability to pause money markets in their lending network. When activated, this will temporarily stop the ability to supply and/or borrow additional tokens from a market. This feature will not affect any current positions, including a user’s ability to repay loans or withdraw collateral. Pausing functionalities can halt an attacker in the midst of draining a market, thus preventing additional funds from being stolen. The ability to call this function will only be given to whitelisted addresses."

"We will release a report analyzing the token transfer logic of all tokens currently used in our partners’ lending networks. In addition, we will continue to update this report for tokens listed by network owners in the future to ensure there are no vulnerabilities presented within a token’s contract. This report will be publicly listed on Ola Finance’s Gitbook."

"The Ola and Fuse teams are working on a UI to facilitate the distribution of funds and will share access to the UI once complete." "We have collected final data concerning those affected by the attack and have developed a joint compensation plan between all parties involved."

"Compensation from Ola Finance will be provided as follows: Ola Finance pledges 400K of its future token distributed over 1 year from the TGE (date to be determined) and split proportionately among victims based on their percentage of the total amount stolen. Ola plans to generate 100M tokens, thereby designating 400K OLA as 0.4% of the total supply to reimburse the victims. While the future price of the Ola token is currently undetermined, victims have the option of receiving immediate compensation by converting their future token options to USDC at the value of $1 per Ola token. Currently, this option is limited to $200,000; however, should demand exceed this, Ola will work to bring in additional funds."

"1/2 Standing together, @ola_finance and @voltfinance remain united in our efforts to compensate users suffering from the latest exploit. All projects accept responsibility and ask our communities to focus on the next steps of growth, rather than assigning blame."

"The lending market will be reinstated as soon as both parties, along with security partners, are confident that ample measures have been taken to mitigate any future risk. The estimated time is 1–2 months."

"The gains [were] tunneled via Fuse Bridge and currently funds still stay in the hacker’s account."

Transparency Report, Compensation Plan, and Future Steps

On April 8th, Ola Finance published a joint Medium post with a transparency report, compensation plan, and future steps. TBD more content from report.

In this joint blog post we aim to provide a complete overview of events concerning the very unfortunate exploit which took place on 31st March leading to the theft of over $4 million and plans to make amends to those affected. It will also help community members and those interested to understand the relationship between Fuse/Voltage Finance and Ola Finance moving forward and our commitment to continued collaboration in order to make DeFi easier and more inclusive.

Proactive Against Other Exploits

In May, an exploit was found in Rari Fuse. The Ola Finance team validated that their protocol was not vulnerable and posted an update for the community. TBD more details on the Rari Fuse exploit.

Total Amount Recovered

Ola Finance put together a reimbursement plan for affected users.

"The gains [were] tunneled via Fuse Bridge and currently funds still stay in the hacker’s account."

TBD - Need to fill in details of the reimbursement outcomes.

Ongoing Developments

The initial gains were originally tunneled via the Fuse Bridge. It is not clear whether funds have been recovered from the attacker's account. TBD - Need to find out what happened here.

Individual Prevention Policies

The Ola Finance platform did not have sufficient auditing, and should therefore have been considered highly risky. Participants should apply pressure to ensure that more auditing is performed and avoid using platforms that have insufficient auditing.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Additional smart contract security audits from multiple reputable firms stand a very high chance of uncovering price manipulation vulnerabilities.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

A collective industry insurance fund would be able to cover losses. The loss amount can be minimized by having the majority of funds in offline cold storage protected by a multi-signature wallet. Funds can be introduced into liquidity pool as necessary to handle protocol usage.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Assessment by multiple specialized firms stands the greatest chance of detecting potential exploits. An industry insurance fund should align incentives to prevent loss to platform participants.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.