Polter Finance hack — November 2024

Polter Finance, an unaudited fork of the Geist lending protocol running on Fantom, was drained on 16 November 2024, with the loss surfacing publicly early on Sunday 17 November. The protocol priced BOO, SpookySwap's token, through a ChainlinkUniV2Adapter contract that derived a value from the spot state of a SpookySwap Uniswap-V2-style pool rather than an independent feed, and had no check for sudden price movement.

The attacker flash-borrowed BOO from SpookySwap's V2 and V3 pools — 269,042 and 1,154,788 BOO respectively, by Three Sigma's account — emptying the reserves the adapter read. With the pool nearly drained, the oracle valued a single BOO at roughly $1.37 trillion. The attacker deposited one BOO as collateral, borrowed against it, and took 9,134,844 wFTM out of the lending pools before repaying the flash loan.

The dollar size of the loss is contested, but the divergence is a valuation-date artefact rather than a disagreement about what was taken: the quantity, 9,134,844 wFTM, is undisputed. Priced at the time of the attack, SolidityScan and Halborn both put the loss at approximately $8.7 million, and Decrypt reported that security firms had arrived at roughly $7 million. Three Sigma, and the founder's Singapore police report citing about S$16.1 million, both give approximately $12 million, which corresponds to a materially higher FTM price than prevailed on 16 November. This entry records the at-incident valuation of $8.7 million as the headline figure, with $7 million and $12 million as the bounds of the reported range. Decrypt separately reported the pseudonymous founder's own losses at $223,219.

Polter had not commissioned its own audit, relying instead on the audit of Geist Finance, the protocol it forked — Halborn notes the team "didn't perform a security audit of their protocol, instead providing a copy of the one from the Geist contract to its users". The team paused the protocol and made an on-chain appeal to the attacker seeking a negotiated bounty. There was no response and the funds were not recovered.