We are currently investigating the attack on sDOLA LlamaLend markets. Investigation shows that it is made possible by a combination of which price oracle is used for sDOLA (e.g. whether affected by donation attacks) vs how much sDOLA existed outside of collateral in this market.
The attacker made a relatively small profit, but the attack emphasized the importance of handling vault collaterals in a specific manner in LlamaLend. Borrowers who borrowed against sDOLA were liquidated, lenders are unaffected, and holders of sDOLA made some profit.
Further investigation is ongoing to verify if any of other existing similar markets can be affected in future and making sure that LlamaLend V2 is made safe with even "donation-vulnerable" vault collaterals at all market sizes. Luckily, oracle code which was made for 2-way LL markets (not deployed) seems to be a good mitigation for such attacks for any vaults: we are studying that in details now to incorporate in all future markets with vault collateral.
twitter.com/CurveFinance/statu...
