DeFi Project Rodeo Finance Hacked for $888,000 in Ethereum

An exploiter was able to run away with roughly $888,000 in Ethereum from Rodeo’s interest-bearing USDC pool.

2 min read

Jul 11, 2023

Arbitrum-based Rodeo Finance has lost $888,000 in a recent attack.

A “ForceInvestment” hack was deployed, allowing the attacker to steal 472 Ethereum ($888,000). The wallet later sent 150 ETH into mixer Tornado Cash, leaving 371 ETH remaining in the wallet.

The exploiter originally funded 50 ETH from Tornado Cash to execute the hack.

Arbitrum is a popular layer-2 scaling solution for the Ethereum network that uses optimistic roll-up technology.

Blockchain security firm PeckShield, first highlighted the attack on Twitter with a link to the attack transaction commenting, "Hi, @Rodeo_Finance you may want to take a look."

The attacker used the “Investor.earn()” function to force a swap from Rodeo’s interest-bearing USDC pool. First, the exploiter took 290 Wrapped Ethereum (WETH) from the pool, bridging the assets to the Ethereum network before using oracle manipulation to inflate the price of their ETH by swapping it for unshETH.

unshETH is a DeFi project aimed at promoting validator decentralization by creating a marketplace for staked ETH liquidity in which validators compete to offer the best yield.

When the above swap is performed, the slippage control—the difference between a trade’s order and its execution—is invalid. This meant that the conversion of WETH to unshETH did not reflect a fair market value.

The attacker then bridged back to the Ethereum network to steal another 230 WETH from the Rodeo vault.

Before bridging back to the Ethereum network, sending 150 ETH into Tornado Cash and leaving 371 ETH in the wallet.

A total of 520 WETH was grabbed from the Rodeo vault but only 472 WETH is counted as losses. This is due to the attacker funding the wallet with 50 ETH to execute the exploit.

PeckShield originally reported this as a $1.5 million loss but later corrected it to a $888,000 loss due to a double calculation.

Get crypto news straight to your inbox--

sign up for the Decrypt Daily below. (It’s free).

Get Email!

United States of Bitcoin? These States Are Considering BTC Reserves

Donald Trump and his political allies are plugging away at plans to stockpile Bitcoin at a national level in the U.S. Treasury. And now, with the asset’s price repeatedly soaring to new peaks since Election Day, some U.S. states are following suit. So far, three states are fielding proposals to establish strategic Bitcoin reserves, while digital asset advocates are calling for other local governments to do the same. Bitcoin Strategic Reserve Is Now on the Table—Here's How It Could Work Here'...

AI Won’t Tell You How to Build a Bomb—Unless You Say It’s a 'b0mB'

Remember when we thought AI security was all about sophisticated cyber-defenses and complex neural architectures? Well, Anthropic's latest research shows how today’s advanced AI hacking techniques can be executed by a child in kindergarten. Anthropic—which likes to rattle AI doorknobs to find vulnerabilities to later be able to counter them—found a hole it calls a “Best-of-N (BoN)” jailbreak. It works by creating variations of forbidden queries that technically mean the same thing, but are expre...

Elon Musk and Dogecoin: How the Billionaire Became the 'Dogefather'

As Dogecoin makes a comeback off the back of Bitcoin’s surge, some may be pondering: Where did the asset come from? What’s it for? And what’s Tesla CEO Elon Musk got to do with it? The original meme coin’s boom largely has the world’s richest man to thank. Musk’s obsession with shitposting helped boost the coin to a top 10 cryptocurrency. It’s been a wacky ride over the past few years, culminating in Musk's appointment to co-lead a government agency called D.O.G.E.—yes, really. But we'll explai...

News

Courses

Deep Dives

Coins

Videos