Ribbon Finance, previously known as Aevo, suffers $2.7 million loss in DeFi hack

Attack Overview: A sophisticated attack on Ribbon Finance drained $2.7 million from its old contract, exploiting vulnerabilities in the oracle infrastructure just six days after an upgrade, using a malicious contract to manipulate price feeds and execute fraudulent transactions.

Oracle Vulnerability: The attack was facilitated by discrepancies in decimal precision between newly updated assets and older ones, allowing the attacker to exploit the system by creating poorly structured option products and manipulating expiry prices.

Hacker's Strategy: The attacker created multiple subaccounts to mint options with minimal collateral, taking advantage of the lack of payout limits, which enabled the extraction of significant assets without triggering restrictions.

Clarification on Opyn: Contrary to rumors, the decentralized application Opyn was not compromised; the hack was primarily due to the upgraded oracle code in Ribbon Finance that allowed users to set prices for new assets, leading to the exploit.