# OnyxDAO: fake oToken collateral in liquidateWithSingleRepay drains $3.8M

OnyxDAO's NFTLiquidation contract accepted fake oToken contracts, letting attacker manipulate exchange rate and drain >$3.8M in VUSD, XCN, DAI, WBTC, USDT.

- Payout: Real-world hack
- Severity: critical
- Program: OnyxDAO
- Credited: DeFiHackLabs
- Disclosed: 2024-09-26
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-09/OnyxDAO_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** NFTLiquidationProxy contract (liquidateWithSingleRepay function)
**Root cause:** liquidateWithSingleRepay() trusts caller-supplied oToken addresses without verifying they are legitimate markets, allowing fake contracts to return arbitrary values and manipulate liquidation logic.
**Steps:**
1. Flash loan 2000 WETH from Balancer.
2. Withdraw WETH to ETH, mint oETH, enter markets, borrow oETH to trigger fallback.
3. Borrow all available oXCN, oDAI, oBTC, oUSDT and transfer underlying to attacker.
4. Deploy AttackerC2 to manipulate oETH exchange rate via repeated redeemUnderlying and ETH transfers.
5. Deploy fake underlying, fake oTokenCollateral, fake oTokenRepay contracts.
6. Transfer 1 VUSD to fake_oTokenRepay, call NFTLiquidationProxy.liquidateWithSingleRepay with fake contracts.
7. Fake_oTokenRepay.transfer approves oVUSD max and calls oVUSD.liquidateBorrow(attackerC, 1, oETH), then redeems oETH and sends ETH to attacker.
8. Swap remaining VUSD to WETH via Uniswap V3, repay flash loan, transfer profits to attacker.
**How found:** Likely identified that liquidateWithSingleRepay accepts arbitrary oToken addresses without validation, enabling fake contracts to spoof balances and bypass checks.
**Exploitation:** Attacker used flash loan to mint oETH, then borrowed all available assets from Onyx markets. Deployed fake oToken contracts that returned manipulated values to liquidate a fake position, draining oVUSD and other reserves. Converted stolen VUSD to WETH via Uniswap, repaid flash loan, kept profits.
**Escalation:** Chained flash loan, exchange rate manipulation, fake contract deployment, and liquidation to drain multiple markets in one transaction.
**Insight:** When auditing lending protocols, check if liquidation functions accept user-supplied token addresses and trust their return values; fake contracts can manipulate collateral calculations.