Algorithmic stablecoin Balance Coin lost more than 99% of its value following an attack targeting its oracle pricing mechanism. Rising from around $1 to $0.0014, the token erased almost its entire nominal market cap of around $3.5 million.
According to blockchain security firm SlowMist, the attacker sent an unusually low Bitcoin price to the protocol, causing the liquidation of vaults that would not normally be liquidated. As a result of the attack, approximately $912,000 worth of assets were removed from the 42DAO protocol in a single transaction.
SlowMist said the root cause of the attack was the protocol’s acceptance of a low BTCB price provided via the Median Oracle without sufficient controls. It was reported that the attackers used the “poke” function of the Spotter module and the “bark” function of the Dog module to introduce the manipulated price into the system.
According to the security company, the Spotter module lacked security mechanisms such as price gap control, maximum depreciation limit and minimum price protection. The unusually low price was therefore directly recorded in the accounting module called VAT.
The Dog module’s ability to use the updated price without a waiting period or additional Oracle verification allowed the attacker to instantly liquidate multiple BTCB-backed vaults. The compromised collateral was then converted into other assets, generating a profit of approximately $912,000.
*This does not constitute investment advice.
