UwU Lend Suffers Two Hacks in Three Days, Total Losses Reach $24 Million
On June 10, the decentralized lending protocol UwU Lend suffered a hack, resulting in a loss of nearly $19.3 million. On-chain data shows that the hackers wallet successfully stole a range of tokens, including Wrapped Ether (WETH), Wrapped Bitcoin (WBTC), and stablecoins, most of which were then traded on Uniswap. UwU Lend is a project forked from the open-source code of the Ethereum-based lending protocol AAVE v2. It allows users to lend and borrow digital assets, participate in investment strategies, and manage assets in a non-custodial manner. According to the documentation on its website, the platform prioritizes security, using forked and audited code from AAVE v2 to minimize smart contract risks. However, this recent breach has exposed vulnerabilities in the protocols security measures. Web3 security firm PeckShield stated that the root cause of the attack was an issue with the price oracle, specifically that the pricing of the sUSDe asset came from a median of multiple sources. Five of these sources—FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD, and GHOUSDe—were manipulated during the attack. In the first breach, the attacker used flash loans to manipulate the price of Ethena USDe (USDe) by exchanging it for other tokens, causing the price of USDe and Ethena Staked USDe (SUSDe)









