Themis Protocol

Themis Protocol Suffers $370,000 Loss in Exploit

June 27, 2023
Attack Types: 
Smart Contract Exploit ,Flash Loan Attack ,Price Oracle Manipulation
Entity Types: 
DeFi ,Lending Platform
Target Entities: 
Themis Protocol

Summary # On June 27, 2023, Themis Protocol, a decentralized lending and borrowing platform on the Arbitrum One chain, fell victim to a sophisticated exploit involving a flawed price oracle, leading to a loss of approximately $370,000. The attacker manipulated the Balancer LP token price by exchanging tokens within the Balancer pool, thus affecting the oracle’s valuation of the pool’s tokens. By utilizing flash loans and a series of calculated transactions, the exploiter was able to inflate the price of the Balancer LP tokens and borrow assets far exceeding their collateral, eventually laundering a portion of the stolen assets through Tornado Cash. ...