Lien Finance Attacked, Losses Approximately $542,000

TechFlow reports, July 24, according to SlowMist monitoring, Lien Finance was attacked, with losses of approximately $542,000. The root cause lies in the exchangeEquivalentBonds function in the BondMakerCollateralizedEth contract lacking sufficient multiset integrity validation, only counting the total occurrences of abnormal bonds without verifying the actual occurrence of each bondID group by group.

The attacker concealed the missing abnormal bonds on the input side by reusing the same abnormal bondID in the output group, thereby minting new non-abnormal bond tokens without burning the corresponding input bonds. Subsequently, the attacker used three pre-authorized endpoints to exchange the relevant tokens for USDC, finally transferring 542,144.628604 USDC from the victim address.