Radiant Capital Resumes Arbitrum Markets Operations After Security Breach

Radiant Capital has announced the reopening of its lending and borrowing markets on Arbitrum after an extensive security review.

According to Radiant Capital’s recent post, this resumption came after a detailed review and resolution of the security breach that resulted in a significant loss of $4.5 million Ethereum. The review was completed by OpenZeppelin, independent Ethereum researchers, and white hats.

Following this rigorous analysis, the Radiant DAO Council unpaused market operations. Additional safeguards have been implemented to prevent similar incidents in the future, with a focus on enhanced security protocols.

Security Analysis and Resolution

“Users are free to use all available lending and borrowing markets,” said Radiant Capital in the announcement. “Native USDC will be brought live over the coming days after additional reviews due to the increased complexity of doing so safely.”

To address any potential financial discrepancies arising from the pause, the company disclosed plans for a Snapshot proposal. “A Snapshot proposal for the DAO regarding the methodology to repay the excess debt and fully recapitalize the Arbitrum WETH market will go up for a vote shortly,” said Radiant Capital

“The liquidation bonus will initially be set to 1bps (lowest it can be set) to allow for a grace period for users to improve health scores,” wrote the post. This measure intended to provide users with time to adjust to the resumed operations, before gradually returning to normal levels over the next 24 hours.

We again wish to thank @HypernativeLabs for first bringing this exploit to our attention. There was a Herculean response from the White Hat community to ensure Radiant continues to operate safely. 🧵9/10

— Radiant Capital (@RDNTCapital) January 5, 2024

Based on an analysis by Chaos Labs, Radiant Capital stated that the total collateral at risk of liquidation was smaller than $100,000, and the impact of it could be minimalized by the 1bps bonys.

Radiant Capital Hacked with $4.5 Million Ethereum Loss

The blockchain security company PeckShield Inc. revealed that a hacker breached the network and drained 1,900 Ethereum tokens within six seconds after the new USDC market deployment.

“The root cause is not new: It basically exploits a time window when a new market is activated in a lending market (forked from the popular Compound/Aave),” said PeckShield. “The exploitation also relies on a known rounding issue in current Compound/Aave codebase.”

Radiant Capital also confirmed the hack in their official post and temporarily closed the Arbitrum markets.