0VIX, a lending protocol on Polygon and Polygon zkEVM, has reportedly been exploited for at least $2 million.
The protocol enables borrowing against multiple stablecoins, derivatives of Ethereum and Polygon’s native MATIC token, as well as Aavegotchi’s staked token, vGHST. Aavegotchi is a blockchain gaming project inspired by the popular Tamagotchi game.
The exploit was carried out on the vGHST token.
Officer’s Notes, an independent security researcher, told Decypt that the attackers have already transferred $1.4 million in USDC and $600,000 in USDT via briding protocolStargate Finance as they attempt to transfer funds back to Ethereum and convert the stablecoins to ETH.
The 0VIX team responded by pausing the lending markets temporarily as they investigated the matter.
0VIX is working with its security partners to look into the current situation that seems to be related to vGHST.
As a result, POS and zkEVM markets have been paused this includes pausing oToken transfers, minting, and liquidations.
Only POS has been currently affected but zkEVM…
— 0VIX | live on zkEVM (@0vixProtocol) April 28, 2023
Blockchain security and data analytics firm, PeckShield, reported that the attackers took out a flash loan of $6.12 million in stablecoins to manipulate the vGSHT lending pool on 0VIX.
Blocksec, a blockchain security firm, confirmed that the hackers used the borrowed stablecoins to open vGSHT lending positions and later manipulated the protocol’s price oracle.
Aavegotchi’s native token, GHST, surged 24.7% from $1.13 to $1.41 in less than 30 minutes, according to CoinGecko.
GHST price chart. Source: CoinGecko
The instant price surge of GHST turned the vGHST lending pool insolvent, and the attacker liquidated the pools, making off with the collateral from the pools.
These types of attacks are called price oracle manipulation hacks, which are common in DeFi circles.
Attackers manipulate the price oracle of a low liquid token, like GHST, inflating its price. Then, the attacker exchanges their artificially-inflated holdings for other tokens with ample liquidity and stable price.
Mango Markets on Solana and bZx exchange on Ethereum and BNB Chain were hacked using the same technique for $100 million and $55 million, respectively.
Stay on top of crypto news, get daily updates in your inbox.
Source: https://decrypt.co/138262/polygon-lending-protocol-0vix-pauses-protocol-exploit
