Attacker Drains About $437,000 in Collateral From Premia Vaults

An attacker drained about $437,000 in net collateral from six Premia options vaults on Arbitrum across two transactions, according to The Defiant’s analysis of onchain transfers displayed by Arbiscan.

The first transaction and second transaction executed a second apart at 11:15:39 p.m. and 11:15:40 p.m. ET on Oct. 31. Together, the vaults recorded net outflows of 3.64410382 wrapped bitcoin (WBTC), about 43.47 wrapped ether (WETH), 48,479.36 bridged $USDC ($USDC.e) and 46,215.43 $ARB. The dollar estimate sums those net outflows at Arbiscan’s displayed prices around 12:16 a.m. ET on Nov. 1, rather than historical execution prices.

That left depositors with little collateral held directly in the affected vaults. The WBTC call vault held 0.0008738 WBTC, while the WETH call vault held about 0.0373 WETH in the post-attack snapshots. Those balances do not include a valuation of outstanding option positions.

Security firm Blockaid warned, “Attack still ongoing,” in an alert posted at 12:13 a.m. ET on Nov. 1. That statement describes the firm’s assessment at the time of its alert, not confirmation of the attack’s status at publication.

How Collateral Left the Vaults

Premia’s underwriter-vault documentation describes vaults that pool depositors’ collateral to back call and put options. Buyers pay premiums, and depositors receive shares representing their participation in the vault.

According to Blockaid, the attacker created empty option pools, took flash loans and bought options so that vault collateral became locked in those pools. The attacker then withdrew that collateral as liquidity. In effect, funds committed to backing options became funds the attacker could remove.

The onchain transfers corroborate the collateral’s route. In the first transaction, Balancer’s vault sent WBTC, WETH and $USDC.e to the attack contract. Premia vaults then transferred collateral into option pools, which sent tokens to the attack contract; the contract repaid Balancer. A preceding setup transaction created the six option-pool contracts used in the two draining transactions.

The other affected vaults also retained small directly held balances: the $ARB call vault held about 160.89 $ARB. The WETH, WBTC and $ARB put vaults held approximately 125.73, 88.54 and 45.22 $USDC.e, respectively.