• Sonne Finance's SONNE token plummeted 60% to 2.5 cents after a hack drained $20 million from the decentralized lending protocol.

  • The exploiters used a "donation" attack to manipulate markets. The incident occurred on the Optimism blockchain version; the Base blockchain version was unaffected.

  • The exploit happened after the protocol added token markets for Velodrome Finance's VELO. The attacker took advantage of a two-day timelock to execute four transactions, creating markets and adding collateral factors.

Sonne Finance's SONNE token slumped after the developers acknowledged a hack that drained $20 million from the decentralized lending protocol early Wednesday.

SONNE slid 60% to 2.5 cents, its lowest level in over a year, cutting market cap to $20 million even after the developers said they were able to stop $6.5 million being siphoned off once they realized the attack was happening.

The exploiters utilized a “donation” attack to manipulate certain markets offered by the platform, stealing various tokens before being interrupted. The incident occurred on Sonne’s platform on the Optimism blockchain. The Base blockchain version was not affected. (Think of this as a mobile application getting hacked on Apple iOS, but remaining safe on Android.)

How we used $100 to prevent more than $6.5M from being hacked in @SonneFinance incident today 🧵🧵 pic.twitter.com/wAzXciJe0x

— Tony KΞ (@tonyke_bot) May 15, 2024

How the Exploit Happened

The exploit occurred after the protocol added token markets for Velodrome Finance’s VELO following a recent community proposal. The attacker took advantage of a two-day timelock to execute four transactions, which included creating markets and adding collateral factors.

A timelock contract is a smart contract embedded in a blockchain that executes a transaction at a specific time, in this case, two days after it was locked.

The attacker executed transactions by donating large amounts of cryptocurrency to manipulate the exchange rate between two tokens. That effectively tricked the platform into believing it had more collateral than was really available.

Blockchain data shows the attacker managed to transfer millions of VELO, ether, and USD Coin (USDC) following the manipulation. They later converted this to $8 million in bitcoin and ether and transferred the funds to a new wallet address in early European hours.

#PeckShieldAlert @SonneFinance exploiter-labeled address has transferred $7.8M worth of cryptos, including 100 $WBTC & 556.1 $ETH, to a new address 0x6277...4c07 #Optimism pic.twitter.com/g4oiP5akr4

— PeckShieldAlert (@PeckShieldAlert) May 15, 2024

The protocol had previously avoided similar issues by adding markets with zero collateral factors, manually adding collateral, and permanently removing it before anyone was able to manipulate the market.

In a report on the exploit, the developers said they were working on retrieving the stolen funds and floated a bounty for the hacker.