Key Takeaways:
Edel Finance paused its version-one lending protocol after an attacker inflated a tokenized Google share used as collateral to about 78 times its real value.
The price oracles were correct. The flaw was in how the token was wrapped and unwrapped, which let the attacker borrow real assets against phantom collateral, leaving about $403,000 in bad debt.
Edel says it will cover the losses so depositors are made whole, and has offered the attacker a white-hat settlement.
Edel Finance, a platform for trading tokenized stocks, paused its lending protocol on June 30 after an attacker exploited how it priced a tokenized version of Google's stock, borrowing against collateral inflated to roughly 78 times its true value and leaving about $403,000 in bad debt.
The interesting part is what did not break. Edel used Chainlink oracles, the standard services that feed real prices onto a blockchain, and those correctly reported Google's share price around $357. The weakness was in the wrapping mechanism. The protocol accepted wGOOGLx, a wrapped form of the tokenized share GOOGLx, and the attacker manipulated the exchange rate between the two so the wrapped token was valued far above what it should have been. Then they used that phantom collateral to borrow real assets and walk away.
Edel says it caught and contained the exploit, froze its version-one contracts, and told users not to touch them. No depositor will lose money, the team said, because it is absorbing the bad debt and restoring balances one for one, with a redesigned version two on the way. It has also offered the attacker a white-hat settlement, a deal to return most of the funds for a fee and no charges.
The amount is small, but the method is not rare. Price manipulation ranks near the top of DeFi's most common attack types, and it tends to show up exactly where new value gets bolted onto old systems. Tokenized stocks are one of the fastest-growing corners of crypto, the same wave that has Nasdaq-listed funds going on-chain and cryptographic receipts being stapled to data. Every wrapper that turns a share into collateral is one more seam an attacker can pull at.
People Also Ask
What happened to Edel Finance?
An attacker inflated a wrapped tokenized Google share to about 78 times its value and borrowed against it, leaving roughly $403,000 in bad debt and prompting Edel to pause its lending protocol.
Was the Chainlink oracle at fault?
No. The oracle reported Google's real price correctly. The flaw was in how the tokenized share was wrapped and unwrapped inside the protocol.
Will Edel users lose money?
Edel says no. The team is absorbing the bad debt, restoring balances one for one, and rolling out a redesigned version two to block this kind of manipulation.
What is a wrapped token?
It is a version of an asset repackaged to work inside a specific protocol, meant to track the underlying one for one, here the wGOOGLx form of the GOOGLx tokenized share.
Sources
CoinDesk, OWASP