Onyx Protocol hack — September 2024

Onyx Protocol was an Ethereum lending market forked from Compound v2. On 26 September 2024 an attacker combined two weaknesses. The first is the rounding behaviour that Compound v2 forks inherit: in a market with almost no liquidity, the exchange rate between the market token and the underlying asset can be shifted by donating small amounts, which lets a borrower inflate the apparent value of a tiny deposit. Onyx had recently opened a market for its VUSD stablecoin with negligible supply. Funded by a 2,000 WETH flash loan from Balancer, the attacker pushed a stream of small oETH transactions through the thin market to distort the rate. The second weakness, identified by PeckShield, was in Onyx's NFTLiquidation contract, which did not properly validate untrusted user input and allowed self-liquidation rewards to be inflated.

The attacker removed 4.1 million VUSD, 7.35 million XCN, 0.23 WBTC and roughly $55,000 in DAI and USDT, together valued at about $3.8 million. VUSD lost its dollar peg and traded near $0.39 afterwards. Part of the proceeds was routed through CoW Protocol into ether.

Onyx acknowledged the exploit but disputed the diagnosis, saying the primary problem was the NFTLiquidation contract rather than the empty-market rounding issue. The same Compound v2 rounding flaw had already been used against Onyx in an earlier attack in late 2023 costing about $2.1 million, and against Hundred Finance in 2023.

Governance proposal OIP-46 passed on 29 September 2024. Onyx shut down the Ethereum lending market, said lenders would be reimbursed in full, and relaunched from 1 October 2024 as a permissioned product called Onyx Core.