The algorithmic stablecoin Balance Coin lost over 99% of its value following an attack targeting its oracle pricing mechanism. Falling from approximately $1 to $0.0014, the token wiped out almost all of its nominal market capitalization of around $3.5 million.
According to blockchain security company SlowMist, the attacker transmitted an unusually low Bitcoin price to the protocol, causing vaults that should not normally be liquidated to be liquidated. As a result of the attack, approximately $912,000 worth of assets were withdrawn from the 42DAO protocol in a single transaction.
SlowMist stated that the root cause of the attack was the acceptance of a low BTCB price provided via the Median Oracle by the protocol without sufficient checks. It was reported that the attackers used the “poke” function in the Spotter module and the “bark” function in the Dog module to introduce the manipulated price into the system.
According to the security company, the Spotter module lacked safety mechanisms such as price deviation control, a maximum depreciation limit, and minimum price protection. Therefore, the unusually low price was directly recorded in the accounting module called VAT.
The dog module’s ability to use the updated price without any waiting period or additional oracle verification allowed the attacker to instantly liquidate multiple BTCB-collateralized vaults. The compromised collateral was then converted into other assets, resulting in a profit of approximately $912,000.
*This is not investment advice.
