Conic Finance drained of $3.2 million in security attack

DeFi protocol Conic Finance suffered an exploit today by a hacker who managed to make off with 1700 ether (over $3.2 million), according to security analysts at BlockSec. Conic is a DeFi protocol designed to allocate funds across the Curve decentralized exchange using the liquidity pools it operates.

The unidentified attacker exploited a reentrancy vulnerability, which subsequently allowed the manipulation of a faulty price oracle that Conic relied on. This enabled them to drain funds, said Matthew Jiang, the director of security services at BlockSec, in an interview with The Block.

Such an attack leverages the ability to repeatedly call a function within a single transaction before the initial function call completes. This mechanism lets the attacker withdraw more funds than they’re entitled to.

In the incident around 6:35 am ET today, the hacker executed a flash loan, borrowing 20,000 staked ether, as evidenced by on-chain data. These funds were routed to Conic so its price oracle, which is sourced from a third-party “read-only” smart contract, could be tampered with — facilitating the reentrancy attack — BlockSec explained. “The flash-loaned stETH was utilized to amplify the profit,” Jiang said.

Keeping its community informed, Conic announced in a Twitter post that the team was “investigating an exploit involving the ETH Omnipool” and promised to share further updates.

After what appears to be a second attack, Curve Finance urged users to remove all funds from Conic Finance Friday afternoon. Conic later shut down all deposits across omnipools. 

"Users are still able to withdraw," Conic Finance wrote on Twitter. "We are assessing the situation and will provide updates as soon as we have them."

(Updates with tweet from Curve Finance, additional comment from Conic.)