At dawn on 14/10, a Morpho asset pool was drained after the attacker discovered a flaw in the oracle configuration.
The asset pool on Morpho was drained due to issues related to the oracle
The lending market that was drained on Morpho was the PAXG/USDC pair. An estimated $230,000 worth of assets was lost due to a flaw in the oracle configuration.
1/ $230K @MorphoLabs PAXG/USDC Market Oracle Exploit Breakdown
— omer (@omeragoldberg) October 13, 2024
The Morpho PAXG/USDC market (tokenized gold via @Paxos) was exploited, leading to a $230K loss.
The root cause? A misconfigured oracle pricing gold at $2.6 trillion USD. pic.twitter.com/lVo1MCAIyg
Morpho is a lending project that allows users to actively create decentralized lending pools, and the drained market mentioned above is part of this approach. The person who deployed the market was not clear on the details of Morpho's oracle calculation and configuration, leading to a discrepancy in PAXG pricing.
4/ What Was Wrong With the Oracle?
— omer (@omeragoldberg) October 13, 2024
The Oracle SCALE_FACTOR was misconfigured, failing to account for the differences between decimals in USDC (6 decimals) and PAXG (18 decimals).
This led to a 12-decimal inflation in price, overpricing gold by a factor of 10^12. pic.twitter.com/PllSQnPh6G
With PAXG being significantly overpriced compared to its actual value, the attacker deposited $350 worth of this token and withdrew $250,000 worth of assets from the pool.
Some opinions suggest that this price discrepancy was not quickly detected when deploying the pool because the protocol was more focused on the reference exchange rate, rather than the actual post-calculation price data.
The DeFi community is also following a detail related to LeadBlock (the entity believed to be behind the initiation and operation of this lending pool).
LeadBlock curator on the busted morpho market repaid their loan and exited their liquidity leaving this one poor soul to take all the bad debt
— Togbe (@Togbe0x) October 13, 2024
maybe LeadBlock figured with 5 million and a bunch of EUL tokens this whale could afford it pic.twitter.com/hoOQKJ3Sem
On-chain activities show that this entity quickly withdrew liquidity from the aforementioned pool and left behind a lingering bad debt.
At the time of writing, Morpho has not yet issued an official announcement or statement about this incident.
Compiled by Coin68
You may also be interested in:
Join the discussion on the hottest DeFi issues in the Fomo Sapiens chat group with Coin68 admins!!!
