The attack occurred after Tender.fi upgraded its price feed to relay data from a Chainlink pricing oracle as opposed to a time-weighted average price (TWAP). Tender.fi’s code, which was audited by PeckShield, contained an error and returned a number with too many zeros behind it. That meant the attacker was able to deposit one GMX token, worth around $70, effectively tricking the system into allowing infinite borrows, according to a postmortem published on Tender.fi’s Medium page. There was no issue with the Chainlink oracle itself.
Juiced USDS Yields Woo Solana Traders to Sky’s Stablecoin
The heady growth is about as preordained as anything could be in DeFi. Sky is spending $2 million a month...