Sonne Finance Token Drops 60% After $20M Exploit on Optimism

Sonne Finance's SONNE token slumped after the developers acknowledged a hack that drained $20 million from the decentralized lending protocol early Wednesday.

SONNE slid 60% to 2.5 cents, its lowest level in over a year, cutting market cap to $20 million even after the developers said they were able to stop $6.5 million being siphoned off once they realized the attack was happening.

The exploiters utilized a “donation” attack to manipulate certain markets offered by the platform, stealing various tokens before being interrupted. The incident occurred on Sonne’s platform on the Optimism blockchain. The Base blockchain version was not affected. (Think of this as a mobile application getting hacked on Apple iOS, but remaining safe on Android.)

How the Exploit Happened

The exploit occurred after the protocol added token markets for Velodrome Finance’s VELO following a recent community proposal. The attacker took advantage of a two-day timelock to execute four transactions, which included creating markets and adding collateral factors.

A timelock contract is a smart contract embedded in a blockchain that executes a transaction at a specific time, in this case, two days after it was locked.

The attacker executed transactions by donating large amounts of cryptocurrency to manipulate the exchange rate between two tokens. That effectively tricked the platform into believing it had more collateral than was really available.

Blockchain data shows the attacker managed to transfer millions of VELO, ether, and USD Coin (USDC) following the manipulation. They later converted this to $8 million in bitcoin and ether and transferred the funds to a new wallet address in early European hours.

The protocol had previously avoided similar issues by adding markets with zero collateral factors, manually adding collateral, and permanently removing it before anyone was able to manipulate the market.

In a report on the exploit, the developers said they were working on retrieving the stolen funds and floated a bounty for the hacker.