sdola

sDOLA LlamaLend suffered a flash loan price manipulation attack, resulting in a loss of approximately $240,000, including 6.74 WETH and 227,325 DOLA.The attacker manipulated the sDOLA price through flash loans and donations, increasing the exchange rate of 1 sDOLA from 1.189 DOLA to 1.353 DOLA. This price fluctuation caused multiple accounts in the crvUSD Controller to have health factors below 0, triggering liquidation conditions. After the attack contract acted as a liquidator and received rewards, it exchanged the funds, repaid the flash loan, and made a profit.

Curve Finance posted on platform X that it is investigating an attack on the sDOLA LlamaLend market. Preliminary investigations indicate that the attack exploited a combination vulnerability between the price oracle characteristics used by sDOLA and the amount of sDOLA existing outside of collateral in the market. The attacker profited relatively little, but this incident highlights the importance of handling treasury collateral in a specific manner within LlamaLend.Borrowers using sDOLA as collateral were liquidated, while lenders were unaffected, and sDOLA holders received some returns. The team is further investigating whether other similar existing markets may be impacted and ensuring that LlamaLend V2 remains secure even when facing "donation attack" vulnerabilities in treasury collateral across all market scales.In previous news, YAM Finance responded to the attack on Inverse: suspicious transactions originated from LlamaLend, rather than a contract vulnerability.

Regarding the suspected attack on Inverse Finance resulting in a loss of approximately $240,000, Curve Finance announced on platform X that it has initiated an investigation into the sDOLA LlamaLend attack. Preliminary findings indicate that the cause of this attack is related to the price oracle mechanism used by sDOLA (or influenced by "donation attacks") and the amount of sDOLA that exists in the market without being used as collateral.Although the attacker’s profits were relatively limited, the incident highlights the need for stricter handling when using vault collateral as collateral in LlamaLend. The main impact is that users who borrowed against sDOLA as collateral were liquidated, while unaffected lenders remained unharmed. The Curve team is currently further investigating whether there are other similar markets that may be affected in the future and ensuring that LlamaLend V2 can maintain security even when facing vault collateral assets that are "susceptible to donation attacks" and across different market scales. They are conducting a detailed assessment of related solutions and plan to integrate relevant mechanisms in all future markets that use vault collateral.