BonqDAO's Rekt, An Oracle Attack, Again. $1.2M was lost due to the manipulated oracle. Another example of trying and failing to conquer the Tokenomics Trilemma.
eigenphi.substack.com/p/bonqdaos-rekt-an-oracle-attack-again
Tellor, the oracle that this lending protocol, had a vulnerability in updating the price of WALBT, allowing the attacker to submit a fake price by staking just 10 TRB.
The new quote passed the checks of TellorFlex.sol, allowing the attacker to borrow 100M BEUR in this transaction (bit.ly/3Y4e8u6) with a tiny amount of WALBT pledged to BonqDAO.
You can find the detailed call trace from Blocksec: phalcon.blocksec.com/tx/polygon/0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19
Here is the code of the problem's root.
Our partner @SlowMist_Team has a more detailed explanation: twitter.com/SlowMist_Team/status/1621087651158966274
EigenPhi has systematically studied several DeFi risk events, including the Ankr attack eigenphi.substack.com/p/the-arbitrageur-who-beats-everyone and Lodestar Finance attack, and proposed The Tokenomic Trilemma framework to explain the root cause of these attacks.
eigenphi.substack.com/p/tokenomic-trilemma
The Tokenomic Trilemma puts forward the thesis that a token is difficult to simultaneously achieve three conditions: free tradability, anchored price, and independent issuance.
To mitigate risks like BonqDAO, the industry needs to focus more on liquidity data. We propose that a feedback system based on real-time liquidity sensors is indeed helpful in achieving proactive risk management.
To read more about The Tokenomic Trilemma, visit: eigenphi.substack.com/p/tokenomic-trilemma