Hundred Finance (Gnosis Chain) hack — March 2022

On 15 March 2022 the Gnosis Chain deployment of the lending protocol Hundred Finance was drained through a reentrancy attack.

Tokens bridged to Gnosis Chain through the official bridge are non-standard: they implement an ERC-677-style callback that invokes onTokenTransfer() on the recipient whenever they are transferred to a contract. Hundred Finance, a Compound fork ported from other chains, updated a borrower's debt only after transferring the borrowed tokens out. Immunefi's reconstruction shows the attacker flash-borrowing roughly $2 million of USDC from the SushiSwap USDC-WXDAI pair, supplying it as collateral, borrowing against it, and using the transfer callback to re-enter the protocol and borrow again from a second market before the first debt was written to storage. Repeating that emptied the markets of available liquidity while the attacker's recorded collateral stayed intact; Immunefi puts the total borrowed at over $6 million.

Published loss figures differ. The GIP-40 reimbursement proposal on the Gnosis governance forum states about $6.4 million in user funds, calculated using asset prices at the time of the attack; an earlier thread on the same forum gave around $6.1 million. Both figures are recorded here as bounds. That thread records 72 affected accounts, with individual losses running up to about $1.2 million.

Agave, a separate lending protocol on the same chain, was attacked the same day through the same bridged-token callback. The Block reported combined losses of about $11 million across the two and gave no separate figure for Hundred Finance, which is why the events are sometimes merged into one number.

Gnosis governance discussed reimbursement. GIP-40, posted in late April 2022, proposed that Gnosis DAO and Hundred Finance each cover half the loss, 8,505 GNO apiece for a total of 17,010 GNO, distributed as a token called hvGNO under a six-month cliff followed by a six-month linear vest. The forum thread shows the proposal in draft status and records no final vote or distribution.