Alpha Homora loses $37 million following Iron Financial institution exploit

In one of many largest exploits of the DeFi period, this morning an attacker efficiently drained over $37 million from Alpha Homora by leveraging Cream’s Iron Financial institution protocol-to-protocol lending platform. 

Alpha Finance Lab, whose protocol was audited by Quantstamp and Peckshield, introduced on Twitter this morning that they have been conscious of an assault, that the “loophole” that allowed it had been patched, and that the group had a “prime suspect”:

Pricey Alpha group, we have been notified of an exploit on Alpha Homora V2. We’re now working with @AndreCronjeTech and @CreamdotFinance collectively on this.

The loophole has been patched.

We’re within the strategy of investigating the stolen fund, and have a chief suspect already.

— Alpha Finance Lab (@AlphaFinanceLab) February 13, 2021

The transaction from the exploit is notably complicated. The attacker used Alpha Homora to borrow and lend repeatedly with Iron Financial institution, which permits for leveraged lending. Some analysts have speculated {that a} faked “spell” (Alpha’s branded time period for a wise contract) is what enabled the exploit:

That contract is a faked Alpha Homora spell, Alpha Homora’s system thought it was one in every of their very own;

That “contract” is “owned” by Alpha pic.twitter.com/5OHlWh9Mi1

— Arrundai (@arrundai) February 13, 2021

This “faux spell/contract” exploit conceptually echoes the “evil jar” assault on Pickle Finance that netted an attacker $20 million late final 12 months. In each circumstances, the exploited protocols errantly responded to faked contracts. 

Shortly after the profitable exploit, the attacker “tipped” the Alpha and Iron Financial institution deployers 1,000 Ether every, and likewise made a Gitcoin donation.

Cream Finance mentioned in a press release on Twitter that the Iron Financial institution exploit didn’t impression any of their different contracts, and that their cash markets have been functioning usually:

C.R.E.A.M. contracts and markets have been investigated and located to be functioning as regular. Markets have been re-enabled throughout each V1 and V2.

Publish mortem to comply with.

— Cream Finance (@CreamdotFinance) February 13, 2021

Protocol Bailout?

The query now turns to how customers might be compensated within the occasion the protocols can not stress their “prime suspect” into returning the funds. 

The Yearn.Finance group and MakerDAO set a precedent with “DAOs bailing out DAOs” final week when MakerDAO allowed for the creation of a custom-built collateralized debt place from Yearn’s newly-minted treasury.

Whereas the dimensions of the exploit is bigger than the $11 million Yearn suffered, some have speculated that Alpha will likewise print tokens to cowl the loss — and a few merchants and establishments have already positioned themselves for such a dilution.

Intrepid chain exercise displays seen that Three Arrows Capital despatched over $3 million in ALPHA tokens to Binance this morning, probably with the intention of promoting:

3AC promoting $Alpha? Oh man.. pic.twitter.com/4xjlhZrIze

— Jason La Finance (@Raez_x) February 13, 2021

Presently, ALPHA, the governance token of the protocol which suffered the losses, is down 20% to $1.83; CREAM, the governance token of the protocol that enabled the exploit, is down 16% to $222; AAVE, the governance token of the protocol that the exploiter used for a flash mortgage, is down 2% to $505.