OAK — OnChain Attack Knowledge

Worked example · 2023-04

Paribus diamond-facet exploit — EVM — 2023-04

Loss
approximately $150K extracted from the Paribus protocol's diamond-proxy contract on Ethereum via a post-audit facet-addition vulnerability in April 2023. A recently added facet contained an unprotected external-call path that allowed an attacker to drain approved tokens from users who had granted infinite approvals to the Paribus diamond.
OAK Techniques observed
OAK-T9.008 (Diamond-Pattern Facet-Audit Incomplete) — primary; the Paribus diamond deployed a post-audit facet whose external call path was unaudited and contained a missing sender-validation check, consistent with the T9.008.001 sub-pattern (post-audit facet addition introduces exploit surface). The audited facets matched their audited bytecode; the gap was the newly added facet outside the audit scope.
Attribution
pseudonymous. No public named-individual attribution; the attacker address is identifiable on-chain but was not linked to a known entity cluster.
Key teaching point
Paribus demonstrates that the diamond-pattern facet-audit gap (T9.008) is not protocol-specific — it recurs across independent diamond-pattern protocols whose operators deploy unaudited post-audit facets, with the same failure signature (missing input validation or access-control on the new facet's external-call surface). The incident reinforces that T9.008 is a structural property of the diamond pattern's extensible-facet-set architecture, not a Li.Fi-specific operational error.

Summary

Paribus is a cross-chain lending and borrowing protocol deployed on Ethereum using a diamond-proxy (EIP-2535) architecture. Its diamond contract delegates calls to multiple facet contracts implementing lending-pool logic, liquidation mechanics, and cross-chain bridging pathways.

In April 2023, Paribus deployed a new facet to support integration with an additional DeFi protocol. The facet was added via diamondCut post-audit — the existing audit covered the facets present at the time of the engagement, but the new facet was outside the audit scope. The new facet made an external call to a user-supplied contract address without validating that the caller was the intended integration partner. An attacker deployed a malicious contract that, when called by the new facet, executed a transferFrom against users who had granted infinite ERC-20 approvals to the Paribus diamond, draining approximately $150K.

The incident echoes the Li.Fi July 2024 exploit structurally: a post-audit facet introduces a call-verification gap, the facet is outside the audit scope, and the audit claim (truthful about the audited facets) is misleading about the diamond's overall security posture. The Paribus case, at smaller scale, confirms that the pattern generalises across independent diamond-pattern protocols.

Timeline (UTC)

When Event OAK ref
Pre-2023-04 Paribus deploys diamond-proxy contract; audit engagement covers baseline facet set T9.008 surface (latent)
2023-04 (pre-attack) Paribus operator deploys new integration facet via diamondCut; facet is post-audit and unaudited T9.008.001 (post-audit facet addition)
2023-04 (attack window) Attacker identifies the unaudited facet's external-call path with missing sender-validation; deploys malicious callback contract T9.008 (audit-scope gap exploited)
2023-04 (attack window) Attacker invokes the new facet; facet calls attacker's malicious contract; malicious contract drains approved tokens from users via transferFrom T9.008 extraction — ~$150K
2023-04 (post-attack) Paribus pauses affected contracts; patches the new facet with sender-validation check; issues post-mortem (operator response)

Realised extraction

Approximately $150K. No public recovery.

Public references

  • Cross-reference: T9.008 at techniques/T9.008-diamond-pattern-facet-audit-incomplete.md.
  • Cross-reference: 2024-07-li-finance at examples/2024-07-li-finance.md (Li.Fi v2, canonical T9.008.001 anchor at ~$11.6M).
  • Cross-reference: 2022-07-li-fi-v1-diamond-facet-exploit at examples/2022-07-li-fi-v1-diamond-facet-exploit.md (Li.Fi v1, ~$600K).

Public References

See citations in corresponding technique file.

Techniques demonstrated (1)