Polter Finance lost $12M when its oracle overvalued 1 BOO token at $1.37T, letting the attacker drain lending pools. CloberDex suffered a $514K loss due to a reentrancy flaw in its burnHook logic. Coin31 was drained for $26K after a public setMaster() function allowed unauthorized contract control.
On December 10th, the CloberDex exploit on the Base network resulted in a $514K loss. The root cause of the exploit was a reentrancy vulnerability in the _burn() function of the Rebalancer contract. The problem was that the burnHook function was executed before updating pool.reserveA and pool.reserveB. This allowed the attacker to reenter the function and repeatedly withdraw inflated amounts based on outdated reserve values. The CloberDEX team has acknowledged the incident and paused all transactions.
Exploited Contract (on Base): 0x6a0b87d6b74f7d5c92722f6a11714dbeda9f3895
Private Contract with burnHook function: 0x32Fb1BedD95BF78ca2c6943aE5AEaEAAFc0d97C1
Transaction Hash: 0x8fcdfcded45100437ff94801090355f2f689941dca75de9a702e01670f361c04
On November 16th, the Polter Finance exploit on the Fantom network resulted in a $12M loss. The attacker used flash loans to manipulate SpookySwap’s liquidity pools, inflating the BOO token price. They deposited 1 BOO as collateral, which the oracle incorrectly valued at $1.37 trillion. Using this overvalued collateral, the attacker borrowed 9.1M wFTM, draining the protocol’s lending pool. The latestRoundData() function of the oracle failed to detect price spikes which allowed the manipulated price to pass as valid.
BOO Token (on Fantom): 0x841fad6eae12c286d1fd18d1d525dffa75c7effe
Aave Oracle: 0x6808b5ce79d44e89883c5393b487c4296abb69fe
PriceFeedV2: 0x80663edff11e99e8e0b34cb9c3e1ff32e82a80fe
ChainlinkUniV2Adapter: 0x875d564a6a86f6154592b88f7a107a517f00cc17
Transaction Hash: 0x5118df23e81603a64c7676dd6b6e4f76a57e4267e67507d34b0b26dd9ee10eac
On November 2nd, the Coin31 exploit on the BNB chain resulted in a $26K loss. The root cause of the attack was the absence of access control in the setMaster() function of the token contract. The attacker called the function to set the master address to their own contract, granting themselves control over the Coin31 token pool. This allowed the attacker to drain tokens from the pool and profit. The Coin31 team has acknowledged the incident.
Exploited Contract (on BNB): 0x52fbd9a94587f8ce757d1bd0a89abfe8d6233591
Transaction Hash: 0x28f8e92e64595edf2680a40c5ca1dcfddf2a74fde6f2b51efc09d31edef09d0f