bZx Flash Loan Attacks

Summary

bZx was an Ethereum margin-lending and trading protocol, launched by Tom Bean and Kyle Kistner (co-founders since August 2017), fronted by two interfaces: Fulcrum (tokenized lending / margin trading, June 2019) and Torque (crypto-collateralized loans, October 2019). In mid-February 2020, bZx suffered two exploits within four days that together drained roughly $900k–$950k of protocol equity. Neither attack "hacked" a private key or exploited a memory-corruption bug in the classic sense; instead they abused flash loans — uncollateralized loans that must be borrowed and repaid inside a single atomic transaction — to acquire enormous temporary capital, distort on-chain prices, and extract value before the transaction settled. The bZx incidents are widely credited as the events that turned flash-loan-driven price-oracle manipulation from a theoretical concern into a repeatable, industry-wide DeFi attack pattern.

Design (Mechanism)

The exploits chained together several composable DeFi money legos in one transaction:

Attack 1 (Feb 15, 2020, tx 0xb5c8bd94...): The attacker flash-borrowed 10,000 ETH from dYdX (which only checks collateralization after all operations complete). They deposited 5,500 ETH into Compound as collateral to borrow 112 WBTC, then opened a 5x leveraged ETH/WBTC short on bZx's Fulcrum. bZx routed that position's conversion through Kyber into a thin Uniswap WBTC pool, effectively buying WBTC at a hugely inflated rate (~110 BTC per unit vs. a market ~36). The attacker then dumped the 112 Compound-borrowed WBTC into the now price-distorted Uniswap pool for ~6,871 ETH, repaid the dYdX flash loan, and kept the difference. Crucially, a bugged collateralization check let the under-collateralized bZx short go through: a require statement's first condition (sentAmounts[6] == sentAmounts[1]) short-circuited the shouldLiquidate oracle check, so the "unhealthy position" guard never fired.

Attack 2 (Feb 18, 2020, tx 0x762881b0...): This one was pure oracle manipulation. The attacker flash-borrowed 7,500 ETH, used a portion to buy up nearly all the sUSD available on Kyber (via its Uniswap and Synthetix reserves) across ~18–19 trades, spiking the ETH/sUSD rate on Kyber. They separately bought sUSD cheaply from the Synthetix depot, then posted the accumulated sUSD as collateral on bZx to borrow ETH. Because bZx read the ETH/sUSD price directly from the manipulated Kyber market, it drastically overvalued the sUSD collateral and let the attacker over-borrow ETH, repaying the flash loan and pocketing ~2,378 ETH of profit.

Outcome

bZx froze the protocol during each incident and, notably, covered user losses out of its insurance fund / treasury so depositors were made whole rather than absorbing the loss directly. The attacks did not kill bZx immediately, but they became the template for a wave of 2020–2021 flash-loan oracle attacks (Harvest, Value DeFi, Cheese Bank, and many others). bZx itself was later hit again — a September 2020 duplicate-token bug ($8M, mostly recovered) and a November 2021 private-key/phishing compromise of a developer ($55M across chains). The protocol migrated to the Ooki Protocol / Ooki DAO. In September 2022 the CFTC settled charges against bZeroX, LLC and founders Bean and Kistner ($250k penalty) for offering illegal leveraged retail commodity trading without registration or KYC, and pursued the successor Ooki DAO under a novel theory that token-holder governance constituted an unincorporated association / general partnership.

Why it worked

• Atomic composability: Flash loans plus same-block interaction across dYdX, Compound, Uniswap, Kyber, and Synthetix let an attacker with almost no starting capital command five- and six-figure ETH positions risk-free within one transaction.
• Spot-price oracles on thin liquidity: bZx priced collateral and positions off instantaneous on-chain DEX rates (Uniswap/Kyber), which are trivially moved when a single actor supplies enough temporary capital to drain a pool.
• A latent logic bug (attack 1): the collateralization guard could be bypassed, so even the protocol's own safety check failed to reject the manipulated position.

Where the design broke

From bZx's perspective the design "failed" because it treated manipulable spot prices as trustworthy oracles and assumed no actor could marshal enough capital to move markets — an assumption flash loans destroyed overnight. A prior anti-manipulation "spread check" that compared prices in both directions did not save attack 2, because both Kyber reserves (Uniswap and Synthetix) used similar constant-product-style pricing and got skewed together, keeping the spread within tolerance while both legs were wrong. Repeated later exploits (2020 and 2021) reinforced a reputation for insecurity that, alongside the CFTC enforcement, ultimately eroded the project.

Lessons

• Never price collateral off a single-block, single-venue spot rate. Use time-weighted average prices (TWAPs), multiple independent feeds, or dedicated oracle networks (Chainlink) that are expensive to manipulate for a full transaction.
• Flash loans make "how much capital could an attacker have?" the wrong question — assume unlimited temporary capital. Security models must hold even against an adversary who can borrow the entire liquidity of the ecosystem for one transaction.
• Cross-check redundant safety guards for short-circuit logic. Attack 1 succeeded partly because a compound require condition let the manipulated path skip liquidation checks — belt-and-suspenders guards are worthless if one clause bypasses the other.
• Composability is a shared-fate attack surface: integrating dYdX, Compound, Uniswap, Kyber, and Synthetix meant weaknesses in any pricing venue became weaknesses in bZx.

Redesign (EDITORIAL — hypothesis, not fact)

If rebuilt today, bZx-style leverage should divorce collateral valuation entirely from manipulable spot DEXes. A modern redesign would (1) source prices from Chainlink or a multi-oracle median with staleness and deviation bounds, plus an on-chain TWAP as a manipulation-resistant sanity check, and reject any trade where instantaneous price deviates beyond a tight band from the TWAP; (2) add per-block borrow/withdraw caps and circuit breakers that halt when an asset's price moves faster than a plausible threshold within one block; (3) require positions to be opened and (potentially) liquidated across at least one block boundary for large sizes, denying pure single-transaction atomicity to size-sensitive actions; and (4) simulate every integration under an "attacker has infinite flash liquidity" threat model before shipping. The broader editorial takeaway: composability is a feature, but each external price surface a protocol trusts is an oracle it must defend as if it were internal.