TL;DR#

On June 27, 2023, Themis Protocol was exploited on the Arbitrum One chain due to a flawed price oracle, which resulted in a loss of funds worth approximately $370,000.

Introduction to Themis#

The Themis Protocol is a decentralized, multi-chain-supported p2p lending and borrowing platform.

Vulnerability Assessment#

The root cause of the exploit is an inaccurate Balancer LP token price oracle. The attacker manipulated the LP token price by exchanging tokens within the Balancer pool, the price of which is determined by aggregating the total value of all tokens in the pool.

Steps#

Step 1:

We attempt to analyze the attack transaction executed by the exploiter.

Step 2:

The exploiter initially took a flash loan of around 40,000 WETH from AAVE and two of the Uniswap V3 pools and deposited 220 WETH as collateral in order to borrow assets worth 44,758 DAI, 85,753 USDC, 58,824 USDT, 85,149 ARB, and 1.09 WBTC.

Step 3:

The exploiter then created a new attack contract to exploit the protocol.

Step 4:

Specifically, they spent 55 WETH to join the Balancer pool and obtain 54.665 B-wstETH-WETH-Stable gauge BLP, all of which were deposited into Themis.

Step 5:

Then, the attacker swapped 39,725 WETH into approximately 2,423 wstETH to manipulate the B-wstETH-WETH-Stable-gauge BLP price and borrow 317.62 WETH from Themis with the manipulated price.

Step 6:

This led them to swap 2,423 wstETH back to 39,724.9 WETH, after which they repaid the flash loan and took away the remaining funds in ETH, USDC, and USDT as profits.

Step 7:

The stolen funds were cross-chained via Stargate Finance into ETH and remained at this address. At the time of this writing, the exploiter had laundered assets worth 191 ETH into Tornado Cash.

Aftermath#

Following the exploit, the team acknowledged the occurrence of the incident and stated that they had temporarily suspended their borrowing functions.

The team is working on their plans to retrieve the funds from the hacker as a win-win for everyone involved. Provided that there is no response from the attacker or a lack of willingness to collaborate on their efforts, the team will reportedly seek the help of authorities to rectify the issue.

A compensation plan is in place for all the affected users, and they are likely to share a post-mortem report after the 'dust settles'.

Solution#

The attack succeeded because the attacker was able to artificially manipulate the price of the token through a flawed oracle. The incident brings attention to a few key principles for DeFi project safety.

For DeFi protocols, the security of Price Oracle is essential. Using trusted price oracle services that aggregate price data from multiple sources and guard against manipulation can help mitigate all such exploits. Regular contract audits and rigorous testing could identify potential vulnerabilities and help rectify them before they are exploited.

Additionally, a well-designed economic model that considers potential attack vectors can mitigate the risk of exploitation. This could involve creating safeguards that limit maximum profit from trades or incorporating an automated system that temporarily halts trading in the event of drastic price changes.

At Neptune Mutual, we understand that preventing such attacks is as important as providing robust coverage when they occur. If Themis Protocol had established a dedicated cover pool in the Neptune Mutual marketplace before the incident, the impact of this exploit could have been significantly reduced for the affected users.

Our platform offers coverage to users who have suffered a loss of funds or digital assets due to smart contract vulnerabilities. This is possible thanks to our unique parametric policies, which don't require users to provide loss evidence to receive payouts. Once an incident is resolved through our incident resolution system, users can claim their payouts. Currently, our marketplace is available on three major blockchain networks: Ethereum, Arbitrum, and the BNB chain.

Moreover, Neptune Mutual's experienced security team would have evaluated the Themis Protocol on multiple fronts, including DNS and web-based security, frontend and backend security, and intrusion detection and prevention measures. These assessments aim to identify and address potential vulnerabilities before they can be exploited, enhancing the overall security of the platform.

Reference Source PeckShield