Lien Finance BondMaker: ~$542k USDC via bond equivalence logic
SlowMist reported ~542k USDC lost after attackers abused Lien’s bond exchange path.
We verified live BondMakerCollateralizedEth contracts on Ethereum expose exchangeEquivalentBonds(exceptionBonds[]) and permissionless registerNewBondGroup: matching both the multiset-validation and open-registration narratives.
Victim address still holds residual USDC after the event. Same BondMaker family as the 2020 white-hat save; this time funds left.
369 take
Open bond/ticket registration plus soft equivalence or OTC pricing is a loaded gun.
Before you LP into structured “bond” pools, ask whether anyone can mint paper the pool will buy without hard collateral checks.
Sources