Atomic Green loses over 29,000 dollars due to signature replay attack

The DeFi protocol Atomic Green has been hit by a security incident in which an attacker managed to steal nearly $30.000 in USDC. According to research by SlowMist, a cybersecurity firm specialising in blockchain security, the attack was the result of a so-called signature replay vulnerability.

How the attack was carried out

The hacker exploited a critical flaw in Atomic Green’s signature process. The signed data lacked several security elements, including a position ID, position manager, caller address, nonce, deadline and chain ID binding. This allowed a single signature to be reused across 21 different position IDs.

Because of this flaw, the attacker was able to burn entire liquidity positions in Uniswap V3 without authorisation. This happened while the price was artificially manipulated via a flash loan attack, which yielded additional profits for the attacker. The transaction took place on the Arbitrum network and generated extra gains through an arbitrage trade from ARB to USDC.

What made this attack possible

The vulnerability was exacerbated by the protocol’s failure to perform price and slippage checks. This meant the manipulation of liquidity prices could go unnoticed. Such security mechanisms are standard in modern DeFi protocols to deter attackers.

SlowMist identified the attacker via the address 0xf8803dae13a6757e53711214769b5fb52ec26c7e. The hacked position manager proxy and the vulnerable contracts have now been fully mapped for further analysis.

Why this matters for DeFi

This incident fits a broader pattern of security issues in the DeFi ecosystem. Like earlier break-ins at other protocols, it underscores how critical it is for developers to thoroughly test their code and have audits carried out. SlowMist helps projects identify such flaws before they can be exploited.

For users of DeFi protocols, this is a reminder of the importance of caution. Using lesser-known projects carries additional risk, especially when they have not yet undergone extensive security audits.