Worked example · 2023

Hundred Finance Compound V2 fork exploit — Optimism — 2023-04-15

Loss

~$7M–$7.4M drained from Hundred Finance's Optimism deployment (Decrypt reports Hundred's initial ~$7M estimate and CertiK's $7.4M figure). The attacker inflated the hWBTC exchange rate by donating WBTC to an empty market inherited from the Compound V2 cToken design.

OAK Techniques observed

OAK-T9.007 (Fork Substrate Vulnerability Not Mitigated — primary. Hundred Finance forked Compound V2's cToken design, which carries the empty-market exchange-rate weakness, and listed a market without seeding it). OAK-T9.011 (Precision-Loss / Rounding Attack — a WBTC donation into the empty hWBTC market inflated its exchange rate, and rounding on redemption paid out the difference). The previous T9.004 label had no source support and was removed 2026-10-11.

Re-mapped 2026-10-11

merged with the duplicate 2023-hundred-finance-compound-v2-fork-cascade, which placed the exploit on Gnosis Chain (it was Optimism) and cited nothing.

Attribution

pseudonymous — attacker address identified on-chain; no named individual (Decrypt reports no attacker identification and that the team was trying to open communication).

Corrected 2026-10-11

the exploit hit Optimism (not Arbitrum or "other EVM chains"); the mechanism was a WBTC donation inflating the hWBTC exchange rate in an empty market, not a governance-to-market access-control gap or a flash-loan-driven manipulation; unsupported cross-chain cascade claims removed.

Key teaching point

Forking a DeFi protocol copies not only the code but also the vulnerability surface. A Compound V2 cToken market that is empty (or near-empty) lets a donation distort the exchange rate; the fork operator must seed or otherwise protect new markets rather than assume the upstream design is safe.