Sonne Finance Token Drops 60% After $20M Exploit on Optimism

As an experienced analyst, I believe that the Sonne Finance hack is a significant setback for the decentralized finance (DeFi) community, particularly on the Optimism blockchain. The exploiters’ use of a “donation” attack to manipulate markets and steal millions of dollars worth of tokens is a reminder of the potential vulnerabilities in DeFi protocols.

As a financial analyst, I would rephrase it this way: I discovered yesterday that Sonne Finance suffered a significant setback when their SONNE token value dropped following an unfortunate disclosure by the developers. They admitted to a hack that led to the theft of approximately $20 million from their decentralized lending platform.

Sonne’s value plummeted by 60% to reach a low of 2.5 cents, marking its lowest point in over a year. Consequently, its market capitalization shrank to $20 million, despite the developers’ claim that they successfully halted the theft of $6.5 million once they became aware of the cyberattack.

Malicious actors took advantage of a “donation” scheme to manipulate specific markets on Sonne’s platform, based on the Optimism blockchain. They managed to make off with several tokens during this attack. Importantly, the incident did not impact the base version of the platform running on a different blockchain. (Imagine an app being breached on iOS but remaining secure on Android.)

How the Exploit Happened

As a researcher, I’ve come across an incident where an exploit occurred in the protocol after the addition of token markets for Velodrome Finance’s VELO following a recent community proposal. An attacker successfully took advantage of the two-day timelock to execute a series of transactions, which involved creating markets and adding collateral factors.

A smart contract on the blockchain, referred to as a timelock contract, is designed to carry out a transaction automatically two days following its locking or initialization.

An attacker manipulated the exchange rate between two tokens by making large cryptocurrency donations for transactions, giving the impression to the platform that they had greater collateral on hand than in reality.

The blockchain records indicate that an intruder successfully moved large quantities of VELO, ether, and USDC after the manipulation incident. Subsequently, they exchanged these assets for approximately $8 million in bitcoin and ether. The stolen funds were then transferred to a different wallet address during early European hours.

In the past, the protocol circumvented comparable predicaments by incorporating markets with no collateral requirements, adjusting collateral manually, and eliminating it permanently prior to any potential market manipulation.

In the report concerning the security breach, the developers announced their efforts to recover the stolen funds and proposed a reward for the capturing hacker.