Hope Finance exploit results in $2M stolen from users' funds

cointelegraph.com:

Prospective users of an Arbitrum-based decentralized finance (DeFi) project have been left out of pocket following a $2 million exploit.

Web3 security firm CertiK flagged the incident on Feb. 21, following an announcement from the Hope Finance Twitter account notifying users that they had been scammed.

#CommunityAlert @hope_fin have announced the community has been scammed for ~$2m making this the largest #exitscam on Arbitrum in 2023.$1.86m was transferred to @TornadoCash.Hope_fin have posted steps for user's to withdraw their staked LPhttps://t.co/hJbFXiKujt

Details of the project are difficult to come by. The platform’s Twitter account was launched in January 2023 and outlined plans for an algorithmic stablecoin called $HOPE which dynamically adjusts its supply relative to the price of ETH.

Posts on the account allege that a Nigerian national had executed the scam and had transferred over $1.86 million to Tornado Cash shortly after the platform went live on Feb. 20. A member of the CertiK team told Cointelegraph that the scammer had changed details of the smart contract which led to funds being drained from Hope Finance genesis protocol:

According to a Tweet dated Feb. 13, the Hope Finance smart contract was audited by a Cognitos Audit official. Cointelegraph reviewed the audit summary, which flagged two major contract function vulnerabilities. 

This included an incorrect modifier and the possibility for reentrancy attacks. Despite flagging these vulnerabilities, Cognitos found that the smart contract code had passed the audit successfully.

Following the scam, Hope Finance shared information with users to withdraw staked liquidity from the protocol through an emergency withdrawal function.

Steps to withdraw your staked LP