Omm exploit postmortem | January 2023
Yesterday, the Omm protocol was attacked through a smart contract exploit. The hacker successfully drained $1.9M of user funds from the Omm markets in the form of IUSDC, USDS, bnUSD, and sICX.
Investigations are ongoing, but here’s what we know so far.
What happened?
On January 21 at 07:06:37 UTC, a hacker deployed a malicious contract to exploit a bug in Omm. Over the course of 18 malicious transactions, the hacker was able to withdraw IUSDC, USDS, and bnUSD collateral that wasn’t theirs. They then supplied the stolen USDS as collateral in order to borrow sICX.
The bug was present in the Redeem function, which takes an address to represent the collateral being redeemed. An external call was able to inject a bad smart contract, which allowed them to redeem collateral without first supplying any.
The hacker used Balanced to exchange the majority of the funds, which caused bnUSD and other stablecoins to deviate significantly from their target price of 1 USD.
They also used Orbit Bridge to move IUSDC from ICON to other blockchains, like Ethereum and Polygon.
The hacker also transferred ICX to several exchanges.
How the contributors and community responded
The issue was first reported by Omm community members, who noticed abnormally high APYs available on some of the stablecoin markets. Unusual trading volume was also reported on Balanced.
The Omm contributors and other community members investigated the issue, and discovered that the high APYs were caused by collateral being withdrawn from the Omm reserves via the Redeem API call.
These actions were taken by the ecosystem participants:
- Deactivated all Omm markets, and set the supply and borrow rates on the stablecoin reserves to 0
- Halted all actions on Balanced to prevent further trades and limit the impact on users
- Worked with Orbit Chain to halt IUSDC bridge transactions
- Reached out to several exchanges to identify and freeze ICX in some of the wallets associated with the attack
- Notified Stably, who disabled all new issuance and redemption transactions for USDS at 14:26 UTC as a precautionary measure
- Reached out to market makers to understand the unknown exchange/market maker wallet address
- Sought legal advice about how to proceed
With the help of community members, we were able to identify all the wallet addresses involved in this exploit.
Hacker’s ICON addresses
Main exploit wallet: hxc35cffe7c582cb313820fa6838dd357027ad3d07
From this address, IUSDC were then transferred to:
- hx51f13e696c1b0d17f57696bdc22c6cd697706086
- hxc308be82c57c7190ce623a3f39e0db39c7aa93ab
- hx2cb7cfad74447a5f47f109690599a1916f349a52
- hxd5271567e1121bdba855cbedd12163cb38e48e65
ICX was transferred to:
- hx800acdc3572ce5a8f380de36a5ab77ea0a05046f
- hxff440439df44a8ed26ca566344b54fd33c82f923
- hxd5271567e1121bdba855cbedd12163cb38e48e65
- hx9736efa26fd50d5f5f14848cf0cc5274dac6aba3
- hx12a838246027e89fde92a681c41e5e0f37af5383
- hxd66ce835aed5fa887d895b85358ec2c7a035d8cd
- hxae7e22a2e04bd55d278bbf42e1557e65cca5283e
- hx51f13e696c1b0d17f57696bdc22c6cd697706086
Exchanges used by the hacker:
- hxe5327aade005b19cb18bc993513c5cfcacd159e9 (suspected to be XGO, funded the main exploit wallet - reached out)
- hx6b91c8dea3114de74ecfa85908b875778c2b599c (suspected to be Bybit – in contact)
- hx85532472e789802a943bd34a8aeb86668bc23265 (suspected to be OKX - in contact)
Addresses on Ethereum and Polygon that received USDC via Orbit Bridge:
- 0x00082ff22852c7d3eaa157abe343f9b8e64cfd85
- 0x7e4d6232c47789df03d5849675438605c6efa60e
- 0x3b074b585864884035409a091aafd1e3749e152a
- 0x49fedf6ff59c5f35ce53e6a31738cf84172eab55
- 0x517dfb8643363e3bbb034d6ce59b99ef13dd22d6
- 0xA28408FD24cA1BE5e666e30eEcA59Cf8cdeBa448
How bad was it?
The hacker only stole collateral from the Omm markets. The exploit did not affect Boosted OMM, the OMM liquidity pools, or any of the assets held in the DAO Fund.
After analysing the smart contracts and identifying which wallets we can recover funds from, these are the numbers we’re looking at:
Stolen:
6,743,265 sICX
599,704 IUSDC
342,898 USDS
264,111 bnUSD
Recoverable:
2,741,431 sICX (has already been recovered from the hacker’s wallet)
242,460 IUSDC (frozen by Orbit Chain)
Outstanding:
4,001,834 sICX (~927,224 USD at current market prices)
357,244 IUSDC
342,898 USDS
264,111 bnUSD
Total value stolen = 1,891,477.80 USD
Omm’s net balance before the exploit:
36,471,881 sICX (~$8.45M)
599,704 IUSDC
342,898 USDS
264,111 bnUSD
66,608 BALN (~$10K)
1,294,510 OMM (~$9K)
Total net value before the exploit = $9.68M
As a result, the total value stolen represents ~20% of the total net value in Omm.
These are all the actions we think the hacker took after stealing the funds:
- Swapped 737,407 sICX for 845,753 ICX
- Swapped 264,214 bnUSD for 1,061,459 ICX
- Sent ~1.9M ICX to an exchange suspected to be Bybit to be sold
- Sold ~650K ICX, sent ~1.25M ICX to another exchange/market maker
- Swapped 344,443 USDS for 43,328 IUSDC
- Swapped 3.26M sICX for 325,754 IUSDC
- Transferred 726K IUSDC to Ethereum and Polygon via Orbit Bridge. Another 242K IUSDC is stuck on Orbit Bridge.
- Hacker’s ETH has been commingled with ETH from an exchange, suspected to be TradeOgre
So of the $1.9M stolen, roughly:
- $775K (40%) was lost to arbitrageurs
- $726K (38%) was sent to Ethereum/Polygon
- $400K (21%) in ICX is held by exchange wallets ($150K (8%) in an exchange suspected to be Bybit, $250K (13%) in an exchange suspected to be OKX)
What happens next?
First of all, we want to thank everyone who supported Omm during this tough time. While the exploit negatively affected many ICON community members, it was great to see everyone come together to investigate the case and trace the hacker’s movements. Without your help, the investigation couldn’t have progressed as far as it has.
We’re unsure how long it will take for activity to resume on Omm, but we’ll keep the community up to date on Discord and Twitter. As all smart contracts have been halted, borrowers are not at risk of being liquidated by any price movements in the interim.
The smart contract developers have been working non-stop to minimise the impact and assess the damage of the exploit, and are now reviewing what needs to be done to bring Omm back online safely.
Part of this includes fixing the Redeem bug, which has been identified and will be pushed soon. The fix will allow the contract to accept the Reserve address as an input, verify that the Reserve address is part of the Omm reserve, and get the token address from there.
The Omm contributors will continue to work with Orbit Chain and others to recover as much of the stolen funds as possible. We’re still trying to identify all exchanges the hacker interacted with, and are in the process of flagging all associated wallet addresses to prevent the further movement of funds.
All assets that can be recovered will be collected in an Omm Recovery Fund and used to reduce the losses borne by Omm users.
We’re also putting out a call to the traders who benefited from this arbitrage opportunity.
These profits were earned from the extreme volatility caused by the Omm exploit, and gained at the expense of the ICON DeFi community. Please consider donating your arbitrage profits to this address: hx6d36daba20cf74d54ff6e863f7f6e0a2653ed8aa.
A message to the hacker
For the next 48 hours, we’re assuming this was the work of a white hat hacker. To claim that title and prevent further action, you can return the stolen funds to hx6d36daba20cf74d54ff6e863f7f6e0a2653ed8aa on ICON and 0x0Bb7e89613d6520856D4DE6fF97E65D1329A0497 on Ethereum, minus a 10% bounty for bringing this smart contract flaw to our attention.
You can also reach out to Omm on Twitter or contact the early contributors on Discord.
After 48 hours have elapsed, we’ll be forced to assume malicious intent and will notify the US Department of Justice and criminal authorities.
