Lien Finance faced a major blow when an attacker drained over $542,000 in USDC by exploiting a vulnerability in its bond token exchange process. The flaw allowed the creation of bond tokens without destroying the originals, enabling the hacker to mint unbacked assets and exchange them for real liquidity.
Mechanics of the Attack
Security firm SlowMist identified the exploit targeting the bond exchange mechanism within Lien Finance's BondMakerCollateralizedEth contract. By manipulating the exchangeEquivalentBonds function, the attacker bypassed the protocol's controls, generating new bond tokens while retaining the input bonds. This loophole permitted the withdrawal of approximately 542,144.63 USDC from the protocol's liquidity pools. The attacker’s wallet was traced to the address 0x0d7d…1808a.
Underlying Protocol Vulnerabilities
On-chain analysis by DefimonAlerts revealed the root cause lay in permissionless bond registration and a faulty pricing logic. The attacker registered a new batch of bonds containing a malicious payment function via the same contract, then routed these bonds into Lien Finance's OTC pools. These fake bonds were swapped for genuine USDC liquidity, resulting in a significant financial drain. Multiple contracts, including Lien Finance's GeneralizedDotc, were compromised.
This incident joins a growing list of DeFi attacks this July, marking another example of how inadequate validation and pricing checks can lead to extensive losses. Lien Finance has yet to publish a full technical postmortem on the exploit.
