An exploit on the Base blockchain revealed serious vulnerabilities, leading to the theft of about $1 million and raising questions about security in the DeFi sector.
On October 25, Cyvers Alerts reported that an attacker used a vulnerability in Wrapped Ether (WETH) smart contracts, manipulating the price to withdraw funds. The initial suspicious transaction allowed the hacker to withdraw $993,534 from unaudited contracts on Base, with a significant portion later transferred to the Ethereum network, including $202,549 routed through Tornado Cash. An additional $455,127 was stolen using the same method.
Cyvers Alerts’ Hakan Unal noted that the issue stemmed from using an inadequately secured oracle, which was easily manipulated. To prevent such incidents in the future, DeFi platforms are advised to choose more reliable oracles with high liquidity and conduct thorough contract audits.
