The decentralized finance ecosystem faces renewed scrutiny after Sonne Finance, a non-custodial lending protocol operating on the Optimism Layer 2 network, fell victim to a sophisticated exploit that drained approximately $20 million in user funds. The incident, which came to light in mid-May 2024, underscores the persistent vulnerabilities lurking within forked codebases and the critical importance of rigorous smart contract auditing.
The Exploit Mechanics
The attacker exploited what security researchers identified as a classic “donation attack” vulnerability — a known weakness in protocols forked from Compound v2. In this type of exploit, the attacker manipulates the exchange rate of a market by donating a large amount of the underlying token directly to the contract. This artificially inflates the value of the attacker’s collateral, allowing them to borrow significantly more than they should be entitled to.
The attack was executed through a series of carefully sequenced transactions on the Optimism network. The attacker first created a new market on Sonne Finance, then exploited the donation vulnerability by transferring tokens directly to the market contract. Because Sonne Finance’s contracts did not properly account for direct token transfers, the attacker’s collateral appeared much larger than it actually was, enabling them to drain the protocol’s liquidity pools.
Bitcoin, trading at approximately $62,900 at the time of the exploit, saw its own market relatively unaffected, but the incident sent ripples through the DeFi community, particularly among protocols built on similar Compound v2 architecture.
Affected Systems
The exploit specifically targeted Sonne Finance’s markets on the Optimism network. Sonne Finance is a decentralized lending protocol that allows users to supply and borrow various cryptocurrency assets. The protocol operates as a fork of Compound v2, a widely-used lending platform in the DeFi space.
Multiple lending pools were drained during the attack, including those holding Wrapped Ether (WETH), stablecoins, and other ERC-20 tokens. The total losses were estimated at approximately $20 million, making it one of the more significant DeFi exploits of the second quarter of 2024.
Importantly, only the Optimism deployment was affected. Sonne Finance’s deployments on other chains remained intact, as the vulnerability was specific to certain market configurations on the Optimism network.
The Mitigation Strategy
Upon detecting the exploit, the Sonne Finance team moved quickly to pause all affected markets on Optimism, preventing further drainage of funds. The protocol’s response team published an on-chain message to the attacker, offering a bug bounty in exchange for the return of stolen funds — a common negotiation tactic in DeFi security incidents.
The broader DeFi community responded by conducting emergency reviews of other Compound v2 forks to identify and patch similar vulnerabilities. Several protocols proactively paused their markets as a precautionary measure while security teams conducted thorough assessments.
Security firms including Halborn and Olympix published detailed analyses of the exploit, providing the community with a clear understanding of the attack vector and recommendations for preventing similar incidents in the future.
Lessons Learned
The Sonne Finance exploit serves as a stark reminder that forking well-established protocols does not guarantee security. While Compound v2 has been battle-tested over years of operation, the nuances of market configuration and the handling of direct token transfers require careful implementation specific to each deployment.
Key lessons include the critical importance of comprehensive smart contract audits before launching new markets, the need for real-time monitoring systems that can detect unusual transaction patterns, and the value of circuit breakers that can automatically pause markets when anomalous activity is detected.
The incident also highlights the interconnected nature of DeFi risks. When one protocol is exploited, it can create cascading effects across the broader ecosystem, particularly when multiple projects share similar codebases.
User Action Required
Users who had funds deposited in Sonne Finance’s Optimism markets should monitor the protocol’s official communication channels for updates on fund recovery efforts. The team has indicated plans for a comprehensive remediation process, though the timeline and specifics remain under development.
More broadly, DeFi users should diversify their holdings across multiple protocols rather than concentrating funds in a single platform. Users should also verify that any protocol they interact with has undergone thorough security audits from reputable firms and maintains active monitoring and incident response capabilities.
With Bitcoin holding steady around $62,900 and Ethereum at approximately $2,949, the broader crypto market remains active, but individual protocol risks continue to pose significant threats to user funds. Vigilance and due diligence remain the most effective tools for protecting digital assets in the DeFi landscape.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before interacting with any DeFi protocol.
donation attack on a compound v2 fork in 2024? these teams need to stop copy-pasting code and actually read the audit reports that already document these attack vectors
the $20M number is staggering for an optimism L2 protocol. makes you wonder how many other forks are sitting on the same vulnerability right now
at least 4 optimism forks still running the same compound v2 base as we speak. the $20M was just the first one that got exploited
4 optimism forks still running the same vulnerable code. its not a question of if they get hit, its when. sonne was just first
compound v2 documentation literally has a section on donation attacks. these teams fork the code but somehow skip reading the README
sonne finance had what, like 3 months of tvl growth before this happened? classic pattern. fast growth on a fork with zero original security work
3 months of TVL is generous, more like 6 weeks of meaningful liquidity. compound v2 forks are a minefield and teams skip audits because the base code was supposedly battle tested