Logo Distributed Networks Institute

Sonne Finance Suffers $20 Million Hack

Summary

On May 14, 2024, Sonne Finance was exploited on the Optimism chain, which led to a loss of nearly $20 million worth of assets including USDC, WETH and VELO. Sonne Finance is a decentralized liquidity protocol that offers Lending, Borrowing and Earning opportunities on Optimism and Base chains. The root cause of the exploit is a precision loss smart contract vulnerability. Sonne Finance’s smart contracts are a fork of CompoundV2, and precision loss vulnerability is a well-known issue with them. The attacker took advantage of the newly deployed VELO market, manipulated its collateral factor, and executed multiple malicious transactions to drain the protocol’s pools.

Attackers

The identity of the attacker remains unknown. The attacker utilized the following Optimism addresses:

Losses

Sonne Finance suffered a loss of approximately $20 million in various assets. Lost assets breakdown:

  • 2,033,723 USDC
  • 162.92 WBTC worth 10,182,500 USD
  • 2,462.83 WETH worth 7,265,053 USD
  • 2,352 VELO worth 312 USD

Timeline

Security Failure Causes

Smart Contract Vulnerability: The root cause of the exploit was a precision loss issue, a widely known vulnerability in CompoundV2 forks. The attacker manipulated the collateral factors of a lending pool, by depositing underlying tokens into an empty market to inflate the value of deposited collateral.