Allbridge Loses $1.65M to Flash Loan Attack on Solana

Allbridge, a cross-chain bridge protocol, suffered its second flash loan pool-ratio manipulation attack in three years, resulting in losses of $1.65 million. The attack occurred on Solana, despite the protocol's promise to fix this type of vulnerability after a similar incident on BNB Chain in May 2023.

The attacker borrowed $1.12 million from Kamino, a Solana lending protocol, and used it to rapidly swap USDC for USDT inside Allbridge's Solana pools. This distorted the ratio between the two assets, allowing the attacker to withdraw more value than they put in. The process was repeated, with the attacker repaying the loan and keeping the difference.

The attack highlights the importance of reviewing and updating security protocols, even after a fix has been implemented. It also underscores the risks associated with cross-chain bridges, which concentrate idle capital in contracts that must trust conditions on two different chains at once.