Cowrie Research

onyx-protocol-opepe-empty-market-donation-exploit-2023-11-01

15 min read

Onyx Protocol oPEPE Empty-Market Donation Exploit (2023-11-01)

  • Name: Onyx Protocol oPEPE empty-market donation exploit
  • Date: 2023-11-01
  • Protocol: Onyx Protocol
  • Chain: Ethereum
  • Category: empty-market exchange-rate inflation / precision-loss redemption / cross-market lending drain
  • Loss: about $2.1 million
  • Summary: The attacker executed Onyx governance proposal OIP-22 to list the new oPEPE market, then launched the first main exploit transaction exactly 60 seconds later: the proposal execution landed in Ethereum block 18476508, and the first exploit tx followed in block 18476513. Inside that fresh listing they recreated the post-Hundred empty-market exploit path. They minted a tiny oPEPE position, redeemed almost all of it so only 2 wei of oPEPE supply remained, donated roughly 2.52T PEPE directly into the oPEPE contract to print an enormous exchange rate, borrowed stronger assets from sibling Onyx markets, and then used truncation in redemption math to pull the donated PEPE back out while burning only 1 wei of oPEPE. The result was about 1,156.9 ETH plus other tokens of bad debt across the rest of the protocol. The sharper launch lesson is that market deployed and even someone deposited first did not create any durable supply floor; governance had opened a fresh market whose first meaningful actor still got to define the opening solvency state.
  • Trigger / entry point:
    • OIP-22 added the PEPE market to Onyx without protective seed liquidity or a collateral quarantine, and the attacker executed that passed proposal themselves in transaction 0xb91e0731a0f1eb0abf884717a065f7282a5daaacd172a0db8d4a61609c978ed8.
    • The new oPEPE proxy at 0x5fdbcd61bc9bd4b6d3fd1f49a5d253165ea11750 inherited Compound-v2-style exchange-rate math that trusts raw underlying balance via getCash().
    • Because the market launched empty, the first meaningful user could drive oPEPE supply down to 2 wei, making the exchange rate hyper-sensitive to direct PEPE donations.
    • Once the exchange rate was inflated, Onyx still accepted the manipulated oPEPE collateral for borrows from deeper-liquidity sibling markets.
  • Root cause:
    • Onyx listed a fresh Compound-style market without dead shares, immutable seed liquidity, or another supply floor that would have prevented near-zero totalSupply.
    • The market’s solvency-critical exchange rate could be inflated by direct PEPE transfers that raised contract cash without minting proportional new oPEPE.
    • Redemption math still contained the same tiny-supply truncation failure that had already been weaponized against Hundred Finance and other forks: at extreme exchange rates, almost 2 wei of shares could be economically required while integer division rounded the burn down to 1 wei.
    • The deeper lifecycle failure was that a passed governance listing was treated as if the market had already earned collateral relevance. Deployment and first-use did not establish a durable opening state; they only exposed an attacker-ownable fresh market to the first actor who arrived.
    • In short: governance opened a new empty market, the accounting let the first user print collateral value inside it, and precision loss turned that printed value back into withdrawable underlying.
  • Exploit path:
    1. The attacker address 0x085bdff2c522e8637d4154039db8746bb8642bff monitored proposal OIP-22, executed it through Onyx governance in block 18476508, and then launched the main exploit exactly 60 seconds later in transaction 0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635 (block 18476513).
    2. They flash-borrowed 4,000 WETH from Aave, swapped it into roughly 2.520870348093423681390050791472T PEPE, and routed the PEPE through helper contracts.
    3. Using a helper at 0xf8e15371832aed6cd2741c572b961ffeaf751eaa, the attacker supplied 1 PEPE and received 5,000,000,000,000,000,000,000,000,000 raw oPEPE units (50,000,000,000,000,000,000 oPEPE at 8 decimals). They then redeemed almost all of it so the market was left with only 2 wei of oPEPE supply.
    4. They transferred roughly 2,520,870,348,093 PEPE directly into oPEPE, inflating exchangeRate = (cash + borrows - reserves) / totalSupply to an absurd level because totalSupply was now 2.
    5. With the manipulated oPEPE entered as collateral, the attacker borrowed about 334 ETH in one loop and then repeated the pattern across additional Onyx markets, ultimately extracting about 1,156.9 ETH plus roughly $60K in MATIC, UNI, APE, USDP, and WETH in the two main drain transactions.
    6. The critical cash-out step came when the attacker redeemed almost all donated PEPE back out. With exchange rate near 1,260,435,174,046,711,840,695,025,395,736, redeeming 2,520,870,348,093,423,681,390,050,791,470 units of underlying required nearly 2 wei of oPEPE economically, but integer truncation burned only 1 wei.
    7. The attacker then liquidated the residual PEPE debt position, repeated the loop against sibling markets, swapped proceeds back to ETH, repaid the flash loan, and retained the remainder as profit.
  • What the attacker needed to be true:
    • The new oPEPE market had to launch without dead shares or non-redeemable seed liquidity.
    • Direct PEPE transfers into the market contract had to increase solvency-critical cash immediately.
    • Onyx had to accept the inflated oPEPE exchange rate as real collateral value quickly enough for cross-market borrowing.
    • Redemption math had to round in the attacker’s favor once supply was pushed down to 2 wei.
    • Sibling markets needed enough liquid reserves for fake oPEPE solvency to turn into real ETH and other borrowable assets.
  • Technical anatomy worth remembering:
    • This was not a novel bug; it was a fast replay of the empty-market Compound-fork exploit family after governance listed a fresh market without fixing the already-known launch hygiene problem.
    • The governance step matters. The attacker did not need to seize governance; they only needed to watch a legitimate passed proposal and be the first actor through the newly opened attack surface. Onchain, that first-actor window was not metaphorical: the proposal execution and the first exploit tx were only five blocks and 60 seconds apart.
    • The direct donation was only the inflation leg. The money was made by pairing that inflated exchange rate with cross-market collateralization and a truncating redemption path.
    • Onyx shows how market-listing operations themselves are part of lending security: a proposal that is safe in broad terms can still be unsafe in its first minutes of execution.
  • Representative transactions and artifacts:
    • Attacker EOA: 0x085bdff2c522e8637d4154039db8746bb8642bff
    • First main exploit tx: 0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635 (block 18476513, 2023-11-01 09:58:47 UTC)
    • Second drain tx: 0x27a3788d504af542681436bfdecf1823f7a8a691d04309ad33e6d3825e899746 (block 18476677, 2023-11-01 10:32:11 UTC)
    • Proposal execution tx (OIP-22): 0xb91e0731a0f1eb0abf884717a065f7282a5daaacd172a0db8d4a61609c978ed8 (block 18476508, 2023-11-01 09:57:47 UTC)
    • Governance proposal creation tx: 0x309f437ece123ee77b5cc2435783578424bb4e30448dedf6f845bd0c2a4e40a6 (block 18449299, 2023-10-28 14:29:11 UTC)
    • oPEPE proxy: 0x5fdbcd61bc9bd4b6d3fd1f49a5d253165ea11750
    • oPEPE implementation: 0x9dcb6bc351ab416f35aeab1351776e2ad295abc4
    • Governance contract: 0xdec2f31c3984f3440540dc78ef21b1369d4ef767
  • Response / mitigation:
    • The incident reinforced that Compound-v2 forks needed explicit empty-market hardening after Hundred rather than relying on normal market launch assumptions.
    • It also showed that governance execution needs market-initialization safeguards: passed listings should not become immediately collateral-eligible without protected seeding or temporary isolation.
    • Secondary writeups also noted that the issue had already been identified in prior audit work, including recommendations to mint or retain fresh supply at deployment rather than leave a zero-liquidity opening state. That made Onyx look less like a surprise and more like a known launch-state defect left live.
    • The healthier mitigation is therefore sharper than someone should seed the market quickly: a fresh listing needs either an irreversible floor that survives runtime reality or a still-binding collateral quarantine until real supplier breadth exists.

Three launch-authority promotions this incident collapsed

  1. A governance-approved market was still only an attacker-owned opening denominator
  • OIP-22 execution made oPEPE reachable, but it did not make the market economically mature.
  • The first meaningful user could still decide the opening capitalization table by minting, redeeming down to dust, and leaving only 2 wei of oPEPE supply outstanding.
  • The important failure was not merely PEPE got listed. It was that governance opened a market whose first live denominator was still attacker-authorable.
  1. That attacker-shaped opening state was still promoted into canonical collateral truth
  • Direct PEPE donation into oPEPE increased raw getCash() without minting proportional shares.
  • Onyx then converted that balance change into exchange-rate truth and exposed the result as ordinary collateral value, as if the market’s opening state had already earned money-good accounting status.
  • The dangerous promotion was therefore not only the market reports an exchange rate, but this fresh, attacker-shaped exchange rate now counts as real solvency input for the rest of the protocol.
  1. That published fresh-market truth still inherited immediate sibling-market spending authority
  • Deeper Onyx markets honored the manipulated oPEPE mark quickly enough for the attacker to borrow ETH and other assets before any launch-window distrust boundary intervened.
  • The later under-burn in redemption math mattered because the protocol had already crossed the decisive line: a first-minute, first-actor, dust-supply market still retained cross-market borrowing and liquidation authority.
  • The durable lesson is that governance approved a listing, the protocol published one opening-state accounting object, and that object may already spend sibling liquidity are three different promotions. Onyx failed all three.

Pattern tags

  • empty-market-exchange-rate-inflation
  • fresh-market-initialization-failure
  • The preserved shape is sharper than generic PEPE memecoin listing got exploited: Onyx let a governance-created market move from proposal executed to borrow-relevant while the opening denominator was still attacker-ownable dust, then reused the familiar Compound-v2 donation-plus-under-burn path inside that fresh listing window.
  • This is also a clean launch happened, bootstrap never really finished failure. Onyx did not just inherit vulnerable exchange-rate and redemption math; it treated market deployed and someone can mint now as if they were already evidence of a durable supply floor and collateral-ready maturity.

Why the exploit worked

  • Onyx granted a freshly listed PEPE market full collateral relevance before any irreversible denominator existed. Once OIP-22 executed, the first meaningful user could still decide what the market’s opening supply looked like, which meant the attacker inherited governance’s unfinished initialization state instead of attacking an already mature collateral object.
  • In that state, direct PEPE donation became solvency authorship. Raw token balance flowed into getCash(), getCash() flowed into exchange-rate math, and the resulting printed oPEPE value was accepted as ordinary collateral truth by sibling markets even though no proportional new shares had been minted.
  • The rounding bug then completed the cash-out path rather than standing alone. Without the redeemUnderlying-style under-burn, the attacker could have printed fake collateral but would have had a harder time recovering the donated PEPE; without the fresh-market dust-supply state, the same truncation would not have been economically meaningful. The exploit paid because launch sequencing, donation-sensitive pricing, and attacker-favorable burn math all lined up in one newly opened market.
  • The governance detail matters because the exploiter did not need to corrupt or capture the proposal process. They only needed to be the first serious actor after a legitimate listing became live. The protocol therefore failed at the exact lifecycle edge where approved by governance was treated as if it already meant safe to define cross-market solvency.
  • That makes Onyx a clean operations-boundary case too: an authorized market-listing action was still allowed to behave like live balance-sheet authority. Governance execution was not just admin plumbing; it directly published borrow-relevant collateral truth before the opening denominator stopped being attacker-ownable.
  • The preserved design lesson is broader than fix the math: durable seed-floor design, launch-window collateral quarantine, governance execution sequencing, and tiny-supply redemption arithmetic were one security object, and Onyx split them apart.

Detection and audit pivots

  • Ask whether market listing and collateral admission are one atomic safe lifecycle or merely adjacent governance actions. If a passed proposal can create a market that is reachable before an irreversible floor or quarantine exists, the most dangerous actor is often just the first user after execution.
  • Reconstruct the publication path from raw PEPE balance to borrow power: underlying transfer -> getCash() -> exchange rate -> collateral valuation. If direct donations can move that whole chain faster than proportional share issuance or collateral quarantine can respond, the market is still attacker-authored at launch.
  • Test fresh-market exploitability explicitly, not only dormant-market replay. The key simulation is first meaningful mint -> redeem to dust -> direct donation -> borrow -> redeem underlying under extreme exchange rate, with supply pinned at 2 wei or similar microscopic states.
  • Check whether seed liquidity is durable or ceremonial. If the intended defense is someone will seed it quickly, ops will execute right after governance, or we can always add the first liquidity ourselves, the protocol still lacks an onchain answer to who owns the opening denominator when the team loses the race.
  • Look for a downstream distrust boundary. Can a just-listed memecoin market stay deployable while collateral factor remains 0, debt caps remain tiny, or recursive borrowing stays off until real breadth exists? If not, governance is still allowed to publish a market before the protocol can safely trust it.

Failure-prevention checklist

  • Treat governance listing as the start of a quarantine lifecycle, not the end of review. A newly executed market proposal should stay collateral-factor 0, borrow-capped to dust, or otherwise locally isolated until irreversible seed liquidity and healthy supplier breadth already exist onchain.
  • Make the opening denominator non-reversible. Dead shares, non-redeemable seed liquidity, or another durable supply-floor design should prevent a fresh market from ever returning to an attacker-owned 2 wei state after the first mint / redeem sequence.
  • Keep direct donations from publishing collateral truth. If raw PEPE transfers can raise getCash() and therefore exchange rate without minting proportional oPEPE, then unsolicited balance changes are still solvency-authoritative writes.
  • Test the whole launch-window exploit pipeline as one object: proposal execution, first-user mint, redeem-to-dust, direct donation, cross-market borrow, under-burn redemption, and liquidation/reset steps should all fail safely together.
  • Encode effective-freshness checks, not just initial-launch checks. If supplier breadth is microscopic, the market should automatically fall back into the same distrust mode regardless of whether it is one block old or one month old.
  • Treat memecoin side listings as balance-sheet policy decisions. Thin-float assets should not gain full cross-market borrow authority merely because governance approved a listing and one user managed to seed the market first.
  • Put blast-radius controls under the market anyway: small debt caps, temporary collateral disablement, and exchange-rate jump alarms should stop one fresh listing from draining deeper sibling pools before ops can react.

Audit prompts

  • After a listing proposal executes, what exact onchain fact proves the new market is mature enough to define cross-market solvency rather than merely exist?
  • Can the first meaningful actor still choose the denominator by minting, redeeming to dust, and then donating underlying before any irreversible floor or quarantine binds?
  • Which balance changes flow from PEPE transfer to getCash() to exchangeRateStored to collateral valuation, and where is unsolicited balance growth supposed to be neutralized?
  • If the intended defense is ops will seed right away or someone can deposit first, what stops an attacker from simply winning that first-user race the way Onyx’s exploiter did within five blocks?
  • At pathological states like 2 wei of oPEPE supply, how many shares should redeemUnderlying burn economically, and where does floor division still let the protocol burn less than that?
  • Which controls would have stopped the exploit after proposal execution but before bad debt reached sibling markets: launch quarantine, non-burnable seed supply, collateral-factor delay, debt caps, or exchange-rate sanity clamps?
  • If the market later becomes thin again, what exact mechanism demotes it back into effectively fresh quarantine instead of assuming that age alone means safety?

Lessons that should already be standard

  • Proposal executed is not the same thing as market safely initialized. Governance can authorize a new attack surface faster than the protocol can make that surface economically mature.
  • The first meaningful user is part of the threat model. If the opening denominator is attacker-choosable, then launch order is already security-critical state.
  • Authorized listing actions should not be live money-good setters. If proposal execution can both create the market and publish borrow-relevant collateral truth, governance has become a launch-time balance-sheet oracle.
  • Direct donation is already collateral authorship when raw token balance feeds exchange rate. Calling the transfer external liquidity does not make it economically earned collateral.
  • Fresh-market bugs are not only arithmetic bugs. Supply-floor design, collateral-enable sequencing, and tiny-supply redemption math either defend together or fail together.
  • Memecoin or long-tail listings deserve stronger distrust boundaries, not more optimism. Thin-float collateral should have to earn borrow relevance through real breadth, not inherit it from governance paperwork.
  • The dangerous window can be the first minute live. If a protocol cannot survive an adversarial first actor immediately after listing, then the rollout is incomplete.

Why this incident matters

  • Onyx is the cleanest freshly listed memecoin market replay of the Hundred-family bug: same empty-market arithmetic, but with the extra operational lesson that the attacker can simply wait for governance to open the door.
  • It preserves the first-interactor version of the pattern, where launch sequencing rather than long-neglected dormant markets creates the empty-state opening.
  • It is also a useful negative exemplar for fresh-market rollout discipline: a passed proposal, deployed market, and first deposit still did not amount to a durable supply floor or a reserve that deserved cross-market solvency authority.
  • The case is a reminder that exploit surface is temporal as well as structural: the most dangerous moment for a new market can be its first minute live.

Internal linkages

Control surface

Graph View

Backlinks