UPDATE 6:55 PM EST: The Opyn team has published an overview of the exploit on the Opyn ETH put options, revealing the loss of roughly 371,000 USDC.
The team explained:
"At the time of this post, we’ve found 371,260 USDC that has been stolen from these contracts, but this amount may change as our investigation continues. 439,170 USDC from outstanding vaults was successfully recovered by a white hat hack that the Opyn team conducted on the Convexity Protocol to mitigate further loss."
The team added that "[i[n order to ensure liquidity for existing oToken holders, we also offered and continue to offer to purchase all ETH Put oTokens that were outstanding at the time of the exploit for 20% above market price on Deribit."
Opyn's developers also stressed that "[a]ll other Opyn contracts other than the ETH Put contracts are not affected by this exploit."
The post included a breakdown of next steps from a security perspective, including a revamp of internal testing and auditing procedures. The team said it will increase the rewards for its bug bounty program.
Ethereum network data suggests that an outside actor or actors executed an exploit of the options issuance platform Opyn, resulting in the loss of an as-yet-to-be-determined amount of ether (ETH).
Word of the exploit began circulating on social media earlier on Tuesday, with observers surmising that those exploiting the Opyn contracts were able to receive both ETH and USDC, a stablecoin.
The ETH put options in question were intended to pay out in the stablecoin USDC upon the time of exercise. However, transaction data indicates that the exploiter received both the USDC as well as their initial ETH.
It’s unclear at this time how much ETH may have been lost. Current estimates range from several hundred ETH to as high as more than 1,000 ETH.
In a tweet posted at 12:56 p.m. ET, the Opyn team confirmed an earlier observation that it had pulled liquidity from Uniswap and was investigating the situation.
“Hey all, it seems like there has been an issue with some oTokens contracts. We are working hard on understanding this issue so we can let help users as best we can. We have removed liquidity from Uniswap in the mean time. Would be best to not open new vaults at the moment,” they wrote.
A request for comment sent to Opyn was not returned by press time.
This story and its headline have been updated with new information.