On Thursday, the Bitcoin-focused Solv Protocol was used, resulting in the removal of approximately $2.7 million in funds from one of its token vaults. The project offered a 10% bounty to attackers.
Conclusion
- The Solv protocol lost nearly $2.7 million after an exploit drained 38 SolvBTC from one of its Bitcoin supply vaults, with fewer than 10 users affected.
- Security researchers speculate that an attacker exploited a double-blind flaw in the BitcoinReserveOffering contract.
- The project has offered a 10% bonus for refunds.
The Solv Protocol is a DeFi platform that allows users to stake Bitcoin through its Staking abstraction layer.
According to a post-event update, around 38 Solv BTC Protocols (SolvBTC), which the project uses for yield and lending activities throughout its ecosystem, have been drained from one of its structured yield funds called Bitcoin Reserve Offerings (BRO).
Solv Protocol said that the incident affected less than 10 users, adding that it will compensate for the loss of 38.05 SolvBTC, which is about $2.7 million.
While the full post-mortem details of the incident have yet to be released, third-party security analysts believe the attacker was able to exploit a double loophole in the BitcoinReserveOffering contract.
In an automated Decurity bot, the exploiter was able to exploit the vulnerability 22 times, which allowed them to top up 135 BRO to around 567 million BRO tokens before converting the funds to SolvBTC.
Meanwhile, a pseudonymous crypto researcher identified as Piro described the incident as a replay attack, a common exploit where repeated calls to a smart contract allow attackers to manipulate internal accounting before properly updating the balance.
Meanwhile, the Solv Protocol has offered a 10% reward if the attackers return the funds to the designated address. Furthermore, the project claims to be working with its security partners to address vulnerabilities.
At the time of publication, the attackers have not yet indicated whether they have returned the stolen funds.
This is one of several attacks that have targeted DeFi protocols of late.
Earlier in the week, Curve Finance’s sDOLA LlamaLend markets were exploited by a vulnerability related to the pool’s oracle configuration, and the attacker reportedly made around $240,000 by manipulating the pricing mechanism using a flash loan for liquidation.
In early February, the CrossCurve cross-chain payment protocol also lost nearly $3 million when attackers exploited a flaw in its smart contract that allowed fake cross-chain messages to bypass gate checks and unlock funds from the PortalV2 contract.
