Enso Finance loses 5.6 ETH due to oracle error

Enso Finance has fallen victim to an attack in which an attacker stole approximately 5.6 ETH (worth around €14.100). The cause lay in an error in the protocol’s oracle price calculation, security firm SlowMist discovered.

In brief:

• An attacker exploited an oracle error in the DPI Strategy Vault of Enso Finance
• Due to an incorrect TWAP calculation, a swap was valued 9.2 times higher than it actually was
• The attacker exchanged 0.683 WETH for 268.42 FARM tokens and cashed in at a much higher valuation

Pricing error

The problem lay in the way Enso Finance values tokens in its Controller contract. When users deposit funds into the strategy vault, two valuations are performed: before and after the tokens are transferred. The difference determines how many shares a user receives.

Enso’s oracle consulted a Uniswap V3 pool to determine the price of FARM tokens. However, due to a configuration error, the field for transaction fees was used as a parameter for the Time-Weighted Average Price (TWAP). This resulted in a far too short observation window, causing the price to sit close to the current spot price rather than an average over a longer period.

Attacker exploits imbalanced liquidity

The attacker profited from the fact that the Uniswap V3 pool was heavily imbalanced. In a single transaction, he exchanged 0.683 WETH for 268.42 FARM tokens on Uniswap V2. However, because the V3 pool valued this swap much higher than the actual amount, it was recorded as a much more valuable deposit. The pool estimated the swap at 6.3 ETH, almost nine times more than what was actually exchanged.

This allowed the attacker to receive an excessive number of shares in the vault, which he subsequently redeemed for profit. Because the protocol had no checks on the consistency of TWAP data or on observations outside normal price ranges, the exploit could succeed.

Investigating the vulnerabilities

SlowMist identified several factors that enabled the attack: the absence of TWAP validation checks, no validation of extreme price deviations, and the reliance on an imbalanced liquidity pool. The attacker has been identified as address 0x3196398321D77a2511d369DCB6eCa9d2aD87b73A. The affected strategy contract held reserves of approximately 5.6 ETH.