Open Finance Exploitation: Episode III and IV

Two attacks targeted Open Finance protocols over the weekend, in which attackers stole about $25.3 million. One of the attackers has already returned $2.79 million, and it’s not exactly clear why or if there was a deal. This comes just two months after a lending protocol bZx saw two successful attacks just days apart. Let’s look at the details.

At around 1 AM ET on Saturday, imBTC pool on Uniswap was drained due to a reentrancy attack vector on imBTC ERC-777 contract and Uniswap v2. imBTC is an ERC-777 token issued by imToken and is redeemable 1–1 with bitcoin. The vulnerability was described 16 months ago. The attacker gained more than $300,000 worth of ETH and imBTC.