On November 1, 2023, the decentralized finance lending protocol Onyx Protocol fell victim to a sophisticated exploit that drained 1,164.53 ETH, approximately $2.1 million at the time of the attack. The breach targeted a newly created and unfunded PEPE token lending market, exploiting a well-known vulnerability in Compound V2 forked code that has now caused cumulative losses exceeding $10 million across similar platforms.
The Exploit Mechanics
The attacker leveraged what security researchers term an “empty pool attack,” a vulnerability inherent in the Compound V2 codebase when initializing new, unfunded markets. Onyx Protocol, a fork of Compound Finance, had recently added a PEPE memecoin lending market through Proposal 22. The alarmingly low community participation in this governance proposal meant insufficient oversight before the new market went live.
The exploit unfolded in several stages. First, the attacker minted oPEPE tokens in the empty pool, then strategically donated assets to inflate the token value. By exploiting a rounding error in the protocol’s redemption logic, the attacker could borrow significantly more assets than legitimately warranted against the overvalued oPEPE collateral. This rounding discrepancy allowed the attacker to redeem more tokens than were actually due, systematically draining the protocol’s liquidity pools.
Blockchain analysis by SlowMist revealed that the attacker’s methods closely mirrored those used in the earlier Hundred Finance exploit, suggesting either the same attacker or shared exploit tooling within the hacking community. The stolen funds—1,164 ETH—were first transferred to an intermediary address before 1,140 ETH were routed through Tornado Cash, a privacy-preserving protocol frequently used to obscure transaction trails.
Affected Systems
The immediate financial impact was severe. Onyx Protocol’s total value locked plummeted 87%, from $2.9 million before the hack to just $392,000 afterward. Beyond the direct theft of 1,164 ETH, the protocol lost an additional 250 ETH as panicked users rushed to withdraw their remaining funds, compounding the damage through a loss of confidence rather than just a loss of capital.
The exploit address (0x085bdff2c522e8637d4154039db8746bb8642bff) and the repeat-exploit address (0x5083956303a145f70ba9f3d80c5e6cb5ac842706) have been flagged by multiple blockchain security firms. Notably, the attacker shared approximately 19.5 ETH of the stolen funds with individuals who contacted them, an unusual gesture that did little to mitigate the broader damage.
The Mitigation Strategy
In the aftermath, the Onyx Protocol team began exploring avenues to compensate affected users and harden their infrastructure. However, the incident underscores a critical lesson for the DeFi ecosystem: forking established protocols without addressing their known vulnerabilities is a recipe for repeated exploits. The same “empty pool” vulnerability in Compound V2 forks has been exploited multiple times across different platforms, demonstrating that the DeFi community has not adequately internalized these lessons.
Effective mitigation requires multi-layered defenses. Protocols should implement thorough audits specifically targeting known vulnerabilities in forked codebases. Governance proposals that add new markets or features should require minimum quorum thresholds to ensure adequate community review. Real-time monitoring systems capable of detecting anomalous borrowing patterns can provide early warnings before full exploitation occurs.
Lessons Learned
The Onyx Protocol exploit reinforces several critical security principles. First, inherited code carries inherited risks—every fork of Compound V2 should treat the empty pool vulnerability as a known threat requiring explicit mitigation. Second, governance participation directly impacts security; Proposal 22 passed with minimal oversight, and the consequences were immediate. Third, DeFi protocols must implement circuit breakers that automatically pause suspicious activity, particularly in newly created markets with minimal liquidity.
For users, this incident serves as a reminder to evaluate the security posture of any protocol before depositing funds. Key indicators include the quality and recency of security audits, the protocol’s governance participation rates, and whether known vulnerabilities in forked code have been explicitly addressed.
User Action Required
If you had funds deposited in Onyx Protocol, monitor the project’s official communication channels for recovery plans and compensation timelines. Verify that any tokens or positions you hold have not been affected by the exploit by checking your wallet against the known exploit addresses. As a general practice, diversify your DeFi exposure across multiple protocols and never deposit more than you can afford to lose in a single platform, particularly those with relatively low total value locked and limited governance participation.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before engaging with any DeFi protocol.
1164 ETH drained and the governance proposal had what, single digit votes? when will defi protocols learn that governance participation below 5% is a security risk
Priya D. single digit votes on a proposal adding a memecoin lending market. governance participation is a joke outside the top 5 protocols
quorum_check 5 votes adding a PEPE memecoin pool to a Compound v2 fork. the governance participation number was the vulnerability not the code itself
compoundv2_arch_ 5 votes adding a memecoin lending pool is basically a rubber stamp on your own exploit. governance apathy was the real vulnerability
compoundv2_arch_ hard agree. governance participation under 5% should be an automatic veto on new market listings. proposal 22 was basically a rubber stamp exploit
compound v2 fork bug strikes again. $10 million cumulative losses across similar platforms and teams keep forking the same vulnerable code without auditing edge cases
fork_this_ the real question is why does anyone still fork compound v2 in 2023. audited alternatives exist but teams pick the easy route
compound_ghost 6 months and 3 audits vs copy paste in a weekend. guess which one every team picks lol
gov_apathy_ single digit votes and a free pass for attackers. at this point governance participation below 10% should auto-block new market listings
compound_ghost because the alternative is building from scratch which takes 6 months and 3 audits. teams pick speed over safety every time
compound_ghost building from scratch with audits takes 6 months and costs 500k. teams will copy paste compound v2 every single time because the incentives reward speed not safety
the rounding error in redemption logic is well documented too. at this point if you fork compound v2 without patching the known empty pool issue youre negligent
rekt_auditor at this point forking compound v2 without patching known empty pool issue is just negligent
adding a memecoin lending market with zero liquidity and no extra safeguards was asking for trouble. the empty pool attack vector was literally documented on compound github
Lian C. documented on the compound github means nothing when teams copy paste the code without reading the issues tab
Kostas N. the issues tab on compound github has the empty pool bug documented since 2020. teams forking without reading it deserve what they get
1164 ETH for a governance proposal that had single digit votes. defi voting participation is basically a free pass for attackers at this point
Compound V2 forks keep getting hit with the same empty pool attack. Onyx added PEPE via Proposal 22 with almost zero participation and nobody reviewed it. 2.1M gone for a governance rubber stamp
governance proposal 22 had almost zero participation and nobody checked if the new pepe market was safe before launching. this is why defi governance is broken
Aisha M. proposal 22 had like 5 votes total. governance participation in defi is a joke outside of the top 5 protocols
governance_watcher proposal 22 had like 5 votes total. governance participation <5% is security risk in defi
1,164 ETH gone because proposal 22 had basically no votes. forking compound v2 and adding a memecoin pool without review is asking to get drained
1,164 ETH gone because Proposal 22 passed with almost no oversight. Compound v2 empty pool attacks have drained over 10M cumulatively and teams keep making the same fork
Tomoko Endo exactly. 1164 ETH for a governance proposal with single digit votes. the attacker literally just waited for someone to add pepe and walked in through the front door
forking compound v2 without patching the empty pool issue is like buying a used car and not checking the brakes. the documentation is literally on the compound github