[ad_1] <br><div><div><p>The assault occurred after Tender.fi upgraded its value feed to relay knowledge from a Chainlink pricing <a target="_blank" href="https://www.coindesk.com/tech/2020/12/22/what-is-an-oracle/" rel="noopener">oracle</a> versus a time-weighted common value (TWAP). Tender.fi's code, which was audited by PeckShield, contained an error and returned a quantity with too many zeros behind it. That meant the attacker was in a position to deposit one GMX token, price round $70, successfully tricking the system into permitting infinite borrows, in keeping with a postmortem printed on Tender.fi's <a target="_blank" href="https://tenderfi.medium.com/march-7-postmortem-170373e93cd1" rel="noopener">Medium page</a>. There was no difficulty with the Chainlink oracle itself.</p></div></div><div><div><p>After extracting $1.6 million from the protocol, the hacker left an on-chain message: "It seems to be like your oracle was misconfigured. Contact me to kind this out."</p></div></div><div><div><p>Tender.fi reached out and agreed to pay the white hat hacker the bug bounty.</p></div></div><div><div><p>The protocol plans to deploy a brand new rewritten oracle contract earlier than unpausing borrowing. It has additionally vowed to repay any unpaid debt left behind by the hacker.</p></div></div><div><div><p><i>UPDATE (March 10, 2023, 14:08 UTC): Updates headline and clarifies in second paragraph that the bug was associated to Tender.fi's code and never the Chainlink oracle.</i></p></div></div> <br>[ad_2] <br><a href="https://www.coindesk.com/business/2023/03/10/defi-protocol-tenderfi-hacker-returns-16m-following-chainlink-oracle-glitch/?outputType=amp">Source link </a>