ANALYSIS OF THE MOBOX SECURITY BREACH

Summary from the TLDR InfoSec newsletter

The MOBOX decentralized lending protocol was attacked on March 14, leading to losses of $750,000. The attack was possible because of a vulnerability in the logic of the contract’s borrow() function that allowed the attacker to burn the pool’s currency which drove up the price while the attacker claimed referral rewards to use for more borrowing. The team recommends that similar lending protocols implement lock-up period restrictions to prevent these attacks.