Hackers Drain $9.3M from More Markets via Efficiency Mode Exploit
A decentralized lending protocol called More Markets on Flow's Ethereum Virtual Machine-compatible layer was hacked on August 31, resulting in the loss of approximately $9.3 million. The attack exploited a combination of an Ankr-issued bonded liquid staking token and Efficiency Mode borrowing feature, draining around 15.5 million Wrapped Flow tokens from its mFlowWFLOW lending reserve.
The security firm Blockaid attributed the attack to the use of Ankr's bonded LST in conjunction with Aave V3's Efficiency Mode on More Markets' platform. This allowed borrowers to access higher levels of liquidity than usual, but also created an opportunity for hackers to exploit the system.
The affected pool was mFlowWFLOW, which carries a loan-to-value ratio of 81.5% and a liquidation threshold of 83%. The protocol's TVL stood at approximately $3.99 million, with around $3.48 million in active loans at the time of the attack.