Secured Finance Lending Market Suffers $104,000 Attack on September 5

The decentralized lending protocol Secured Finance’s lending market was attacked on September 5, resulting in losses of about $104,000. According to Odaily, the issue stemmed from collateral being priced at the average execution price of the current block order book, which allowed an attacker to influence the price through self-trading and have fake borrowing positions counted as valid collateral. The attacker initially deployed a contract but did not execute immediately, then used a flash loan and self-trading to push up the pricing and withdraw USDC. The original attack wallet reverted because of insufficient gas fees, and about 48 seconds later, a general front-running bot named coffeebabe took about 0.9 WBTC, worth about $72,000, and transferred about 28.8 ETH to an ultra sound money builder, keeping only about $29. Another bot later took part of the USDC.