DeFi lending protocol Sentiment has recovered over $900,000 in stolen funds

DeFi lending protocol Sentiment says it has successfully recovered more than $900,000 in stolen funds. The attackers previously stole approximately $966,000 in assets. Sentiment stated that the attackers returned the remaining funds on schedule and that no action will be taken against them. On April 4th, Sentiment was attacked. The Beosin security team analyzed the incident and said, 1. The attacker first called the “joinPool” function of Balancer Vault to stake. 2. Then call "exitPool" to retrieve the pledge. During this process, Balancer Vault will send eth to the attacker to call the fallback function of the attack contract. In this function, the attacker calls the borrow function of the 0x62c5 contract, which needs to calculate the price based on the data returned by Balancer Vault.getPoolTokens(). At present, during the attacker's "exitPool" process, the total supply in the pool has decreased but the data has not been updated. The attacker uses this data error to lend more assets to achieve profit.