Lodestar Finance exploited in flash loan attack

The arbitrum-based lending protocol Lodestar Finance was exploited in the December 10th flash loan attack. According to Lodestar, the attackers manipulated the price of the plvGLP token before using the inflated token to borrow liquidity from all platforms.

Lodestar in a Twitter thread explained attack flow. The attackers first manipulated the exchange rate of the plvGLP contract to 1.83 GLP per plvGLP.

The attackers then supplied plvGLP collateral to Lodestar and borrowed all available liquidity to cash some of the funds until the collateral rate mechanism prevents plvGLP from being completely liquidated.

After the hack, “several plvGLP holders also took advantage of this opportunity and cashed out at 1.83 glp per plvGLP.” minus , notes the DeFi platform.

The attackers made a profit of approximately $5.8 million. Lodestar says about $2.8 million (about $2.4 million) of GLP is recoverable and should be used to pay back depositors. The company is trying to negotiate bug bounties with abusers.

If you are a hacker, please contact us so we can find a white hat contract and move on.

Collecting user funds is our top priority and we will reward your cooperation generously.#hack white hat #Arbitrum $LODE # Exploit #DEFI https://t.co/SWlCr3KMib

Lodestar Finance (,) (@LodestarFinance) December 10, 2022

The main vulnerability that led to the attack was the internals of GLPOracle and how its pricing was conducted. In its analysis, Solidity Finance’s audit team highlighted that the event “has made use of manipulation-resistant oracles a critical component of DeFi, especially in protocols lending user assets.” said.

In a statement, governance aggregator PlutusDAO said: I got it Its product and platform performed exactly as intended throughout the event. also said.

We want to take responsibility for promoting an unaudited protocol. While the exploit was never the fault of Plutus, we recognize the fact that they were too eager to promote a protocol that integrated plvGLP. As plvGLP is gaining significant traction, we highlight all plvGLP integrations to our community to highlight the adoption and opportunities the integrations have presented for both individual users and protocols. Ha, I apologize. We flew our guns.”

The Lodestar attack resembled the Mango Markets exploit on October 11th. In this attack, more than $100 million was stolen from him by attackers manipulating price oracle data, allowing the hackers to avail unsecured cryptocurrency loans.