The popular decentralized finance protocol Pickle Finance was hacked on Saturday, November 21, which drained $ 19,7 million in DAI, a decentralized stablecoin pegged to the US dollar, from a Pickle wallet.
The price of the Pickle token collapses
“According to some reports, our DAI PickleJar strategy has been used fraudulently. We are actively evaluating the situation and will provide further updates, ”the Pickle Finance team announced on their official Twitter account.
The price of Pickle's native token (quotation PICKLE) fell 50,12% to $ 10,17 when the news broke, Messari data reported. It has been up slightly since then and is worth around $ 12,70 at press time. Pickle entered the scene on 11 September as one of many DeFi projects for yield purposes.
The fully automated system rewards users with interest payments and distribution of PICKLE, ether and stablecoins tokens to provide liquidity to different stablecoin pools. The project attempted to bring stability to the price curve of the four major stablecoins, DAI, USDC, USDT and sUSD, which are often detached from their dollar peg.
Pickle's pJars, similar to yearn.finance's vaults, have found and run arbitrage opportunities between stablecoin deposits on different protocols, effectively to push these stablecoins to their anchor, but also to reward Pickle users.
On Friday last week, the team introduced the Jar cDAI, a new strategy aimed at maximizing the returns on DAI deposited on the Compound decentralized lending protocol.
A well-planned attack
Pickle's team and a group of "white hat hackers" quickly got to work on the problem. The first step after the hack was to decrypt the transaction and try to rewrite the code to replicate the attack.
After three and a half hours, the team (now over 10 people) finally figured out how the attack was carried out and tracked down a specific smart contract associated with the DAI theft worth $ 19.759.355, according to a post. .
“This was a very complicated attack and involved many components of the Pickle protocol. At the moment, it does not appear that other funds are at risk, ”they said. "While we work on the fix to remove the attack vector, the White Hat group has determined that no actual details of the attack will be released temporarily."
The team is working to fix the problem as quickly as possible. In the meantime, “We are encouraging all LPs to withdraw their funds from until the issues are resolved,” Pickle's team tweeted.
