dForce wstETH/ETH Curve Gauge Vaults On Arbitrum, Optimism Hacked

• DeFi protocol dForce announced that its vaults on Arbitrum and Optimism vaults were hacked.
• dForce immediately paused the vaults, declaring that the rest of the protocol and funds remains safe.
• Reportedly, the hacker liquidated around $3.6 million worth of ETH.

Integrated DeFi protocol platform dForce posted on its official Twitter account that wstETH/ETH Curve gauge vaults on Arbitrum & Optimism were exploited a few hours ago. The account simultaneously shared that it immediately paused the dForce vaults.

The tweet also mentioned that parts of the protocol remain intact and user funds are secure with dForce Lending. dForce added: We will come back with a detailed report and remedies soon.

Smart contract audit platform BlockSec also tweeted updates regarding the same. It announced that the root cause of the attack was the “well-known read-only reentrancy in the curve pool.”

The Twitter thread continued as BlockSec highlighted the possibility that the price oracle used by dForce’s lending protocol could be manipulated by the attacker. Thereafter, the attacker can liquidate positions at a biased price to make profits.

The loss currently amounted to 1.91 million in Arbitrum and 1.73 million in OptimismFND. Moreover, BlockSec also featured the attack transactions for both OP and Arbitrum.

Meanwhile, blockchain security and data analytics company PeckShield.Inc mentioned that the initial fund worth 0.99ETH was withdrawn from the Private & Anonymous DeFi dApp RAILGUN Project and was transferred to Optimism and Arbitrum through Synapse Network.

Additionally, PeckShield noted that the “illicit gains” worth 2.3k ETH, which values at about $3.65 million, currently remains in the hacker’s account.