Secured.finance lending market drained for ~$104K via flash loan price manipulation exploiting flawed collateral valuation logic.
Security & Exploits ·
Secured.finance's lending market on Ethereum lost approximately $104,000 in a multi-wave exploit beginning September 5. Detection systems identified the attack vector within 45 minutes of an exploit contract deployment, but the lag allowed multiple actors to drain funds: an initial bot extracted USDC through price manipulation, followed by a generalized frontrunner that captured roughly 0.9 WBTC (near $72,000), which was then forwarded to the ultrasound.money builder except for approximately $29 retained by the attacker. Two additional extraction events followed over the next several hours.
The vulnerability centered on how collateral was priced using the getMarketUnitPrice() function from OrderBookLib, which calculated value as total block amount divided by total block future value for orders filled within a single block. Because both sides of these orders were attacker-controlled, an actor could execute self-trades to artificially elevate the price toward par, causing fabricated lending positions to register as legitimate collateral, enabling unauthorized withdrawals from the pool. The isReliableBlock safeguard proved ineffective against flash loan attacks, which execute and settle within a single transaction.
The attack unfolded across at least four distinct transactions, spanning from approximately 22:11 to 00:21 UTC, with varying degrees of success. Whether additional protections or economic safeguards were implemented post-exploit remains undisclosed.