Popsicle Finance has been hacked, the team offered attackers $1 million for the safe return of the funds

By Selena On Aug 5, 2021

Multichain yield platform Popsicle Finance (ICE) is the latest DeFi protocol to fall victim to hackers. In it, hackers were draining around $25 million of ETH from the Sorbetto Fragola liquidity manager.

Mudit Gupta, a core developer for the DeFi “blue chip” SushiSwap, weighed in on the situation on Twitter:

Popsicle Finance exploited, hacker drained ~$25m. The hack was complex but the bug was simple. TX Hash: https://t.co/CqyVvCq5I7

Basically, Popsicle doesn’t transfer the reward debt when users transfer their shares. This exposes multiple exploits, one of which was used here ?? pic.twitter.com/shdYdyemD9

— Mudit Gupta (@Mudit__Gupta) August 4, 2021

‘Audited’ DeFi project Popsicle Finance gets exploited for $25 million

Hackers appear to have exploited smart contracts in the platform’s Sorbetto Fragola liquidity manager. The attackers took advantage of a flaw in the fee accounting mechanism, draining several tokens in the process.

Fragola allows users to optimize yields on Uniswap V3, automatically selecting the best range to ensure the highest yield. However, a bug in the smart contract allowed hackers to trick the contract into paying out yield from the day it was launched rather than when the hacker allocated funds to it. This resulted in hackers continuously withdrawing large amounts of Ethereum, using the same mining method across multiple accounts. In total, the attack is estimated to cost users about $25 million.

The hack was first brought to attention by Ser Daniele Carpèt, a Popsicle Finance team member operating:

Popsicle Finance Got Hacked, Post Mortem as soon as we discover the cause. We will figure it out together and will make it back for our beloved users. Sadly 2 audits where not enough this time…

— Ser Daniele Carpèt ??‍♂️ (@danielesesta) August 3, 2021

Since then, Popsicle Finance has disclosed the hack, urging users to withdraw funds from the affected pools immediately. However, there are still many doubts in this story. The platform’s smart contracts have previously undergone two separate tests from CertiK and Peckshield, both of which returned without any significant issues.

Meanwhile, Peckshield published its audit of Sorbetto Fragola on GitHub on June 28. But strangely, that audit report seems to be missing pages from the start of the report. Nonetheless, their smart contract code review turned up six coding bugs, four of which were classed as medium severity, one low severity, and one informational.

The report states five of the six bugs were fixed, with the medium severity issue of “Incorrect Amount Calculation In burnLiquidityShare()” being “Confirmed.” The noted bugs did not mention flaws to do with fee accounting.

Commenting on Popsicle Finance’s multiple audits, Gupta tweeted:

“To be fair, auditors are humans, and things can slip up. It is fair to expect that this bug will be caught, but there is no guarantee.”

He explains that while the hack is complicated to proceed with, the error in the code is simple. In June, Gupta earned a $10,000 bounty for identifying the same bug in the DeFi WildCredit protocol smart contracts.

After that, Ser Daniele Carpèt offered the attacker $1 million “in completely clean money” for the safe return of the funds. “This is a long shot, but: To the black hat hacker, if you are reading this, we would like to offer $1,000,000 in completely clean money in whatever currency you would like if you return the funds. Let’s stick together and work for the future of finance, rather than be greedy”, he tweeted.

ICE/USD 4-hour chart | Source: TradingView

When news of the hack became public, Popsicle Finance’s ICE token dropped in value, initially dropping more than 55%. At the moment, it has recovered but is still down 30% from yesterday’s price. Despite being exploited, investors still seem to believe in Popsicle Finance and are buying. A similar sell-off occurred after the last hack of THORChain, with the project’s RUNE token recording a massive bounce from the post-hack lows.

Read more: