Cross chain lending protocol Radiant Capital has paused its lending and borrowing markets on Arbitrum after receiving reports of a $4.5 million exploit affecting one of its newly created USDC Coin (USDC) markets.
“Today, we received a report of an issue with the newly created native USDC market on Arbitrum,” said Radiant in a Jan. 3 post on X (formerly Twitter), which they added was later validated by Radiant developers and the wider cybersecurity community.
Blockchain security firm Beosin characterized the recent exploit as a flash loan attack, where the attacker took advantage of a “rounding issue” in the codebase, resulting in a cumulative precision error. This exploitation allowed the attacker to generate profits through repeated deposit() and withdraw() operations. Beosin detailed this information in a post on January 3.
A previous post on January 2 from PeckShield also identified the issue as stemming from a “known rounding issue” within the existing Compound/Aave codebase. According to PeckShield, the root cause is not novel, as it essentially exploits a time window when a new market is activated in a lending market, often forked from popular platforms like Compound or Aave. protocol Radiant Capital
The exploiter successfully drained a total of $4.5 million in Ether (ETH), with the value of Ether at $2,334 per unit, from the protocol. This information is based on data obtained from the Arbitrum block explorer Arbiscanner.
In response to the exploit, Radiant temporarily halted lending and borrowing markets on Arbitrum. The company assured investors that no additional funds are currently in jeopardy. Radiant committed to conducting a comprehensive postmortem analysis and pledged to resume normal operations once the investigation is concluded.
Radiant emphasized that no corrective actions could be implemented until the markets are reactivated on Arbitrum.
Radiant Capital is a decentralized borrowing and lending protocol with cross-chain functionality built using LayerZero technology. The protocol currently has around $315 million in total value locked, according to DefiLlama.