BiFi.finance exploited for $165.4K via interest-computation bug in idle USDT market; attacker flash-loaned 40.5M USDT and was front-run by MEV bot c0ffeebabe.eth.
Security & Exploits ·
BiFi.finance sustained a loss of $165.4K on Ethereum after an exploit targeted a flaw in how the USDT market computed interest on dormant positions. The market had been idle for approximately 264,000 blocks—roughly 36 days—during which time the interest exchange rate froze. An attacker discovered that re-executing certain contract functions within a single block would repeatedly apply the accumulated 36-day interest charge at the prevailing utilization rate, allowing interest to compound artificially on each call.
The attack proceeded in two stages. An initial contract deployed the exploit; one block later, a wallet labeled c0ffeebabe.eth front-ran the original attacker and executed its own version. The MEV bot flash-loaned 40.5M USDT from Morpho, deposited it incrementally into BiFi, and borrowed 30M USDT to artificially elevate the utilization rate. By repeating a withdraw-and-repay cycle twice, it extracted the inflated accrued interest—165.6K USDT—which was then converted to WETH.
The incident highlights risks in protocols where interest accrual logic depends on time gaps between updates. Whether additional safeguards, rate caps, or mandatory interest settlement intervals might have prevented the exploit remains unclear. BiFi has not yet published a detailed post-mortem or recovery plan.