14 May 2024 (exploit tx day, per Sonne)
Sonne Finance: Timelocked VELO Market Creation Enabled Donation Attack
Sonne: on Optimism an attacker executed timelocked VELO market-creation and collateral-factor txs, then used a known Compound v2 donation/precision attack for ~$20M. ~$6.5M saved by seeding VELO.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccounting
- Published
Loss, as sourced
About $20M exploited, per Sonne; remaining ~$6.5M saved after ~$100 of VELO was added to the markets, per Sonne citing SEAL contributors.
Traceability
Primary sources
In brief
Root cause: Per Sonne: known donation attack on Compound v2 forks. Markets were scheduled via 2-day timelock with collateral factors; because Optimism multisig execution is permissionless, the attacker executed market creation and then c-factor txs when the timelock matured, before Sonne's protective path.
Timeline, as sourced: Per Sonne: VELO market proposal passed; txs scheduled with 2-day timelock; attacker executed 4 creation txs then c-factor tx; exploit followed; team aware ~25 minutes later; markets paused.
Account, as sourced
Claimed (Sonne) (post-mortem (opens in a new tab)): previously avoided empty-market risk by adding markets at 0% CF, seeding, then raising CF — process not completed before permissionless execution.
Attacker-related addresses listed in the post-mortem.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/sonne-velo-donation-attack-2024