Hacker Swipes $6.9 Million in Cryptocurrency From DeFi Protocol Lodestar Finance on Arbitrum Blockchain
TechnologyBit News Today2 min read
A hacker has stolen a large sum of cryptocurrency from a decentralized finance protocol built on the Arbitrum blockchain. On the afternoon of Christmas Eve, around a quarter past five, malicious actors exploited a vulnerability in a smart contract for Lodestar Finance, a lending and borrowing platform. They siphoned off a substantial quantity of digital assets, which the DeFi project estimates to be worth several million dollars. ## Hacker Exploits Lodestar Contract
The hacker interacted with an audited smart contract on the Arbitrum blockchain, which currently supports several Ethereum Layer-2 schemes. The smart contract that interfaces with the Lodestar protocol has a serious vulnerability. When the hacker called the atanineVaults function on the contract, they triggered a bug that automatically returned the entire funds in the vault. The contract logic for returning funds did not check if the requester was the owner of the vault.
Lodestar tweeted that it was working with security experts to locate funds and assess the damage. The protocol developers have not yet confirmed the exact amount of cryptocurrency that was stolen, but estimates from the DeFi community place the figure at well over one million dollars. Lodestar says that the team is working on a fix for the vulnerability.
The hacked contract interface is part of Lodestar's atanine vaults, which are criticized arbitrage positions or low-risk yield farms that typically provide more modest returns. They are intended to be more secure and reliable compared to more aggressive strategies. ## Hodlnaut Is Not Involved
Some reports on Twitter initially said that the hack took place on the Hodlnaut protocol. However, Hodlnaut quickly came out to dismiss the rumors, stating in a statement:
"We have received queries regarding the recent hack on Arbitrum involving the Lodestar Finance protocol. We would like to clarify that Hodlnaut is not involved in this incident in any way. Hodlnaut has not been hacked, our assets are safe, and we are continuing to operate as usual. We are keeping a close eye on the situation and will share any relevant updates as soon as we can." ## Arbitrum Vulnerability?
The news of the exploit comes at a sensitive time for Arbitrum, as the Arbitrum Foundation had just announced a major update for the Arbitrum One network. Arbitrum is a popular scaling solution that has seen rapid growth and adoption, alongside Optimism and zkSync, among others. An Arbitrum spokesperson had only to say it was monitoring the situation and would not comment further.
For now, it appears that the problem is limited to the Lodestar protocol itself. Lodestar advised users to avoid interacting with atanine vaults, saying that the vulnerability affects all of them. The developers are considering patching the smart contract to lock the vaults or introduce a new owner moderation function.
