Origin Ether (OETH)

Incident update regarding yield exploitation in our Morpho OETH pool

Today we were notified of a flash loan attack on the OETH Morpho market. The attacker was able to capture a small amount of yield (~0.148 OETH).

No user principal was at risk. We will fully cover the yield lost to the Morpho borrow booster.

Timeline (GMT)

7:30 PM: First alerted to the issue by Dialectic
7:44 PM: Origin team started investigating
8:09 PM: Confirmed as yield theft via flash loan + rebase
9:17 PM: Solution identified and execution began
9:20 PM: Rebases paused
10:08 PM: Fix applied

What happened

The attacker used a flash loan to borrow ~7,557 OETH from the Morpho market, called rebase() to claim yield on the borrowed amount, swapped the earned yield on Curve, and repaid the loan.

First tx: https://t.co/GTJ4xCl6zt

Why this was possible

We’ve always known this was a theoretical risk. However, we intentionally kept rebase() permissionless to maximize decentralization. The growing popularity of our Morpho pool made a meani