OAK — OnChain Attack Knowledge

Worked example · 2020-09

Eminence DeFi flash-loan exploit — Ethereum — 2020-09-28 to 2020-09-29

Loss
approximately $15 million in DAI moved to a single address within about three minutes from the Eminence (EMN) staging contracts [cryptoslate1]. About $8 million was sent back to Andre Cronje [cryptoslate1]; the attacker thus appears to have retained the remainder (about $7M, derived from the two figures). The Defiant described the hacker as returning $8M [defiant1]; CryptoSlate said the $8M went to Cronje and that how he would hand it back was unclear [cryptoslate1].
OAK Techniques observed
OAK-T9.001 (Oracle Price Manipulation — retained from the original classification; the sources describe a bug in the contract's bonding curve rather than a Uniswap price oracle, so a different smart-contract-logic technique may fit better [cryptoslate1]). OAK-T5.002 (Flash Loan-Funded Drain — a flash loan was used to buy up the curve repeatedly [cryptoslate1]). OAK-T17.001 (retained from the original classification; the claim that MEV searchers discovered the unannounced contracts is not supported by the cited sources).
Attribution
pseudonymous The attacker operated from an unidentified Ethereum address. Part of the proceeds (~$8M) was sent back to Cronje [cryptoslate1].
Key teaching point
Functional contracts deployed to mainnet for "testing" are a live attack surface even without a frontend or announcement. Cronje, who said he "tests in production", deployed unfinished staging contracts from the Yearn deployer address; social-media attention pushed deposits from about $3M to $12M within an hour or two, and a bonding-curve bug let a flash-loan user drain the DAI [cryptoslate1].
Corrected 2026-10-11
Mechanism corrected from a Uniswap-LP-price oracle manipulation (with a five-step recipe) to a bonding-curve bug exploited with a flash loan; removed the claims that MEV searchers found the contracts before any announcement and that the attacker attached an on-chain white-hat message; the $8M went to Cronje per CryptoSlate, not to a "Yearn Treasury multi-sig".

Summary

Eminence (EMN) was an NFT gaming ecosystem still in development, with contracts deployed from Yearn.finance founder Andre Cronje's deployer address around 2020-09-28: the EMN token, a GIL (GP) token, and "eTokens" representing coins such as YFI, AAVE, SNX and CRV [cryptoslate1]``[defiant1]. Cronje said the project was at least three weeks from launch and that he "tests in production"; there was no official website or announcement [cryptoslate1].

As social-media attention grew, deposits into the EMN contract rose from about $3M to $12M within an hour or two. A bug in the bonding curve let a user buy tokens up a curve that became extremely steep; the exploiter used a flash loan to buy repeatedly, then sold into the curve, draining DAI from the pool in three successive transactions, about $15M in all, to a single address within about three minutes [cryptoslate1]. About $8M was then sent back to Cronje [cryptoslate1].

Timeline

When Event OAK ref
2020-09-28 Staging contracts for EMN/eTokens deployed from the Yearn deployer address; deposits grow from ~$3M to ~$12M (surface created)
2020-09-28/29 Flash-loan bonding-curve exploit drains ~$15M DAI in about three minutes T5.002 execution
2020-09-29/30 ~$8M sent back to Cronje (partial return)

What this example tells contributors writing future Technique pages

  • Bonding-curve pricing flaws exploited with flash loans are a distinct sub-pattern from oracle manipulation; consider whether T9.001 is the right primary mapping.
  • Mainnet "testing" with real deposits and public attention creates a live attack surface regardless of announcement status [cryptoslate1].

Public references

Techniques demonstrated (3)