Explained: The Orion Protocol Hack (February 2023)

The Orion Protocol, a DeFi liquidity aggregator, was the victim of an attack in February 2023.  The attacker exploited a reentrancy vulnerability to the tune of approximately $3 million in stolen tokens.

Inside the Attack

The root cause of the Orion Protocol hack was a reentrancy vulnerability within the protocol’s smart contracts.  A reentrancy vulnerability exists when a contract doesn’t follow the check-effects-interaction design pattern.  If a malicious contract can reenter a vulnerable function between a call to an external (malicious) contract and an update to the function’s state (i.e. subtracting transferred value from the user’s balance), then the contract is vulnerable to exploitation.

In the case of the Orion Protocol, the attacker created a malicious contract that defined a fake ATK token and implements the reentrancy attack.  The attacker deposited 0.5 USDC, took out a flashloan of 284,700 USDT, and then performed a swap from USDC via ATK to USDT.  Since this chain of swaps involves a call to the token transfer in the malicious contract, the attacker was able to exploit a reentrancy vulnerability to increase their balance in the contract.  Then, the attacker was able to legitimately withdraw their balance for a total theft of about $3 million.

Lessons Learned From the Attack

Reentrancy is one of the best-known and one of the most common attacks against smart contracts.  Many major DeFi projects include reentrancy protections, but, in this case, a potential reentrancy attack vector was overlooked.

Reentrancy and other vulnerabilities can be identified via smart contract audits and bug bounty programs.  To learn more about protecting your smart contracts against these attacks, reach out to our smart contract security experts at halborn@protonmail.com.