Defrost Finance hack — December 2022

Defrost Finance, a leveraged yield-farming and collateralised-debt protocol on Avalanche, was drained in two stages over 23-25 December 2022. The first attack hit Defrost V2: the flashloan() and deposit() functions lacked a reentrancy lock, which let the attacker manipulate the share price of the LSWUSDC vault token and extract roughly $173,000. PeckShield published that finding, and Defrost initially said V1 was unaffected because it had no flash-loan function.

Defrost then disclosed that the attacker also held the V1 owner key. With it they registered a worthless collateral token and a matching malicious price oracle, minted 100 million H2O - the protocol's stablecoin - and used the fake oracle to liquidate existing user positions, draining the real collateral. PeckShield estimated total losses above $12 million; Defrost's total value locked fell from $13.16 million to under $93,000.

CertiK said it could not reach the team and treated the event as an exit scam. Defrost denied a rug pull, and on 26 December said the attacker had returned the funds. In a refund plan published on 1 January 2023 the project stated the balance to be returned to V1 users was 12,850,277 DAI.e, after valuing H2O debt at 0.929 USD and accounting for collateral already impaired by the earlier Terra/UST collapse. It also recorded 27,614 USDC lost by Platypus liquidity providers.

Figures differ: the widely cited estimate is over $12 million, while Defrost's own refund accounting totals $12.85 million. Sources also date the incident variously to 23, 24 or 25 December. No one has been charged, and how the owner key was obtained has never been explained.