DeFi Protocol Dough Finance Loses $1.8M in Flash Loan Attack

The company contacted credit protocol Aave to check if their pools were affected. However, Cyvers confirmed that the pools within Aave were safe.

Web3 decentralized finance (DeFi) protocol Dough Finance has become the latest victim of a flash loan attack, losing $1.8 million in digital assets. On July 12, Web3 security firm Cyvers detected multiple suspicious transactions and contacted credit protocol Aave to ascertain whether their pools were affected. While Cyvers confirmed that the Aave pools remained untouched, Dough Finance bore the brunt of the attack.

According to Cyvers, the attacker was funded through zero-knowledge (ZK) protocol Railgun and exchanged the stolen USD Coin for Ethereum. In total, the attacker managed to siphon off 608 ETH, valued at approximately $1.8 million at the time of the incident.

Web3 security provider Olympix further noted that the exploit was a result of unvalidated call data within the “ConnectorDeleverageParaswap” contract. “The contract did not properly check the data it received during flash loan calls, allowing the attacker to manipulate it to his advantage,” explained Olympix.

This manipulation of the data allowed the attacker to pilfer the platform’s funds. Olympix highlighted that those who had deposited funds into Dough Finance’s exploited contract may be impacted by the hack. However, they emphasized that the Aave pools were not affected by this particular exploit.

“If you have deposited into the exploited contract on Dough Finance, please consider withdrawing your funds to a secure wallet and monitor announcements from the Dough Finance team,” advised Olympix.

“Please refrain from interacting with the protocol until the situation is resolved.”

As Dough Finance users anxiously await further updates, the broader crypto space has already lost over $1 billion in digital assets due to various incidents throughout the year.

On July 3, blockchain security firm CertiK released its security report, revealing that losses from onchain incidents in the first half of 2024 reached $1.19 billion. A significant portion of these losses — nearly $500 million — were attributed to phishing attacks, while private key breaches also took a heavy toll, amounting to approximately $409 million in losses.

CertiK co-founder Ronghui Gu emphasized the critical need to implement multi-factor authentication methods, such as two-factor authentication (2FA) and security keys, to bolster protection against phishing attempts.