White Hat Hacker Returns $1.6 Million to Tender.fi Following Exploit

Tender.fi Exploit and Resolution

A recent exploit on the decentralized finance (DeFi) protocol Tender.fi was resolved with the return of $1.6 million by a white hat hacker. This incident occurred due to a glitch in the Chainlink pricing oracle, which allowed the hacker to exploit the system.

The Vulnerability in Chainlink’s Oracle

The issue arose after Tender.fi upgraded its price feed to Chainlink’s oracle. A glitch enabled the hacker to deposit a GMX token valued at $70 and borrow $1.6 million against it. This was due to a decimal error in the Solidity contract, which miscalculated the token's value.

Hacker’s Ethical Approach

The hacker left an on-chain message highlighting the misconfiguration and requested contact to resolve the issue. Tender.fi's team negotiated with the hacker, who agreed to return the borrowed funds in exchange for a bounty of 62.15 ETH, approximately $98,000.

Restoring Tender.fi’s Operations

Following the resolution, Tender.fi announced on social media that borrowing services had resumed. The platform had paused these services to mitigate risks after the exploit was discovered.

Conclusion

The swift action and ethical approach of the white hat hacker not only secured the return of exploited funds but also highlighted the importance of robust security measures in DeFi protocols. This incident underscores the critical need for continuous monitoring and auditing of blockchain systems to prevent potential vulnerabilities.