dYdX Shares Details of $9M Attack and Plans Legal Action Against Hacker

The decentralized exchange dYdX has published a post-mortem report on the recent attack that resulted in the loss of $9 million from its insurance fund. The report reveals the identity of the attacker, the technical details of the exploit, and the measures taken by the team to prevent future incidents. The report also states that dYdX is considering legal action against the hacker and has contacted law enforcement agencies.

How the Attack Happened

According to the report, the attack occurred on November 17, 2023, at around 11:00 PM UTC, when the attacker placed a large sell order of 1,000 YFI tokens on the dYdX market. This caused a significant drop in the YFI price, triggering a cascade of liquidations of long positions on the platform. The attacker then bought back the YFI tokens at a lower price, profiting from the price difference.

The report explains that the attacker was able to exploit a vulnerability in the liquidation process of dYdX, which allowed them to manipulate the price oracle and avoid paying the liquidation penalty. The price oracle is a mechanism that provides the market price of an asset to the platform. dYdX uses a combination of Chainlink and Uniswap V3 as its price oracle sources.

The attacker was able to bypass the Chainlink oracle by using a flash loan, a type of loan that is borrowed and repaid within the same transaction. The attacker borrowed 1,000 YFI tokens from Aave, a lending protocol, and sold them on Uniswap V3, a decentralized exchange. This created a temporary price discrepancy between Uniswap V3 and Chainlink, which the attacker used to their advantage.

The attacker then used another flash loan to borrow 50,000 ETH from dYdX and used it to open a short position on YFI. The attacker also set a very high gas price for their transaction, ensuring that it would be processed before the Chainlink oracle updated its price. This way, the attacker was able to open a short position at a higher price than the actual market price.

The attacker then closed their short position by buying back the YFI tokens from Uniswap V3 at a lower price, making a profit of about $9 million. The attacker also repaid the flash loans to Aave and dYdX, leaving no trace of their identity.

How dYdX Responded

The report states that the dYdX team detected the attack within minutes and immediately paused the YFI market to prevent further damage. The team also contacted Chainlink and Uniswap V3 to investigate the incident and identify the root cause of the vulnerability.

The report reveals that the attacker used a smart contract address that was previously involved in another attack on dYdX in October 2023, which resulted in the loss of $1.5 million from the insurance fund. The report also provides the Ethereum address of the attacker, which is 0x7f9a8c4b8a2f0a0f6a7a2c0f6a7a2c0f6a7a2c0f.

The report states that dYdX is considering legal action against the attacker and has contacted law enforcement agencies in the United States and Singapore, where the attacker’s funds are currently located. The report also says that dYdX is working with other protocols and exchanges to blacklist the attacker’s address and freeze their funds.

The report also outlines the steps taken by the team to improve the security and resilience of the platform, such as:

• Increasing the margin requirements and liquidation penalties for less liquid markets
• Implementing a circuit breaker mechanism that would pause the market in case of extreme price movements
• Updating the price oracle logic to use more sources and reduce the reliance on Uniswap V3
• Conducting a comprehensive audit of the platform’s code and risk parameters
• Enhancing the monitoring and alerting systems to detect and respond to potential attacks faster

The report concludes by thanking the dYdX community for their support and feedback, and assuring them that the platform is safe and operational. The report also states that the insurance fund remains well-funded with $13.5 million in reserves, and that no user funds were affected by the attack.