NFT lender 'Omni' exploits $1.4m in refinancing attack
Non Fungible Token Lender
Modified Date:- Published Date:-Categories: Cryptocurrency
NFT lender 'Omni' exploits $1.4m in refinancing attack
NFT money market platform Omni lost 1300 ETH (approximately US$1.43 million) in a flash loan reentry attack last weekend, under circumstances similar to DeFi platform Rari Capital's exploit of $80 million in early May. According to a tweet by blockchain security firm PeckShield, the July 10 attack took the form of a hacker borrowing wrapped ETH (WETH) using NFTs as collateral from a collection called Doodle.
According to a tweet by blockchain security firm PeckShield, the July 10 attack took the form of a hacker borrowing wrapped ETH (WETH) using NFTs as collateral from a collection called Doodle. The hacker took advantage of the reentry vulnerability by withdrawing all but one of the Doodle NFTs. This triggered a malicious callback function that allowed the hacker to use the borrowed funds to purchase even more doodles before the loan position was liquidated.
Hacker Uses Borrowed WETH to Buy More NFTs
The remaining NFTs should never have covered the loan position where the resale came from - the attacker was able to use the borrowed WETH to buy more NFTs before liquidating the loan. According to a statement from Omni, the exploit did not affect any customers as only internal test funds were affected, as the platform is still in beta testing mode and all operations have been halted for a thorough investigation.
Data from Etherscan shows that the hacker has already laundered funds through Tornado Cash. This increasingly common practice was also implemented when MM.Finance, the largest DeFi exchange on Cronos, had a vulnerability in its domain name system in May, less than a week after the Rari Capital hack.
NFT Money Market, DeFi Platform, Blockchain security , Etherscan, Cronos, Rari Capital Hack, Cryptocurrency, WETH, Doodle NFTs