Gamma Strategies hack — January 2024

Gamma Strategies, a protocol that runs automated liquidity positions on top of decentralised exchanges, was exploited on 4 January 2024 at 03:42 UTC across four vaults on Arbitrum.

Gamma's post-mortem attributes the loss to an arithmetic mistake in its own automation scripts. The scripts were meant to set a deposit guard that rejected deposits when a pool's price had moved more than about 2 percent, but instead configured a window of minus 50 to plus 100 percent. An attacker used flash loans from Uniswap and Balancer to move pool prices well inside that widened window, then deposited the inflated assets and received a disproportionate quantity of LP tokens, repeating the sequence across five transactions.

The published figures differ substantially. PeckShield and BlockSec, who first flagged the attack, put the loss at roughly $3.4 million, or over 1,500 ETH, and that figure carried through most contemporaneous reporting. Gamma's own accounting, published afterwards, totalled about $6.18 million across the four vaults: roughly $2.74 million from a gDAI-DAI Uniswap vault, $1.36 million from a USDT-USDC.e Camelot vault, $1.31 million from a USDC-USDC.e Ramses vault and $771,000 from a wstETH-WETH Camelot vault. BlockSec's founder described the underlying issue as an inconsistency between how deposits and withdrawals were accounted for.

Gamma sent an on-chain message to the attacker's address proposing a bug bounty settlement. No funds were returned. The protocol suspended deposits while leaving withdrawals open, commissioned an external code review, and set up a recovery pool for affected users funded from protocol revenue plus $120,000 of company reserves, projecting full repayment in around 1.7 years. The attacker has not been identified.