Lien Finance Loses $542,000 in Bond Token Exchange Exploit

Lien Finance lost approximately 542,000 USDC due to a vulnerability in its bond token exchange logic. The attacker exploited a flaw in the protocol's BondMakerCollateralizedEth contract that allowed the creation of unbacked assets and subsequent drainage of liquidity. Security researchers from SlowMist stated that the vulnerability enabled new tokens to be minted and exchanged for real liquidity without destroying the corresponding bond tokens. This incident occurred during July, a period marked by multiple security breaches across DeFi protocols resulting in millions of dollars in total losses.

Attacker Exploits exchangeEquivalentBonds Function in Bond Contract

Blockchain security firm SlowMist announced that the attack targeted Lien Finance's bond exchange mechanism. The attacker used the exchangeEquivalentBonds function in the BondMakerCollateralizedEth contract to create bond tokens without destroying the input bonds and then exchanged them for USDC. This resulted in the withdrawal of approximately 542,144.63 USDC. SlowMist stated that the attack occurred because the bond groups were not sufficiently verified during the exchange. The wallet address used by the attacker was identified as 0x0d7d…1808a.

SlowMist and DefimonAlerts Identify Vulnerability in Bond Registration System

On-chain analysis by DefimonAlerts revealed the attack occurred due to permissionless bond registration and pricing vulnerabilities. The attacker created bonds containing a malicious payment function by registering a new batch of bonds through the BondMakerCollateralizedEth contract. These bonds were routed to Lien Finance's OTC pools and replaced with actual USDC liquidity. Following the attack, several contracts were affected, including Lien Finance's GeneralizedDotc contract. Lien Finance has not yet released a detailed technical report following this attack. Researchers note that such attacks stem from weaknesses in the protocol's pricing and validation logic.

FAQ

How did the attacker exploit Lien Finance's bond system? The attacker used the exchangeEquivalentBonds function in the BondMakerCollateralizedEth contract to create bond tokens without destroying the input bonds, then exchanged them for USDC. This was possible because bond groups were not sufficiently verified during the exchange process.

What contracts were affected by the Lien Finance attack? Several contracts were affected following the attack, including Lien Finance's GeneralizedDotc contract. The attacker registered malicious bonds through the BondMakerCollateralizedEth contract and routed them to Lien Finance's OTC pools.