Ankr ankrFLOW exploit drains $410K from MORE Markets reserve

A vulnerability in Ankr’s ankrFLOW liquid staking contract allowed an attacker to create approximately 8.6 million unbacked ankrFLOW and use the tokens as collateral on MORE Markets, according to a statement from Flow Foundation.

The incident occurred at approximately 06:18 UTC on August 31. After creating the unbacked ankrFLOW, the attacker deposited the tokens as collateral on the MORE Markets lending protocol and used its borrowing functionality to drain around 15.5 million Wrapped Flow (WFLOW) from the protocol’s WFLOW reserve.

Blockchain security firm Blockaid initially estimated the impact at approximately $9.3 million. The company later corrected that figure, saying 15.5 million WFLOW was worth about $410,000 at the spot FLOW price. Blockaid said the attacker ultimately realized approximately $250,000 after slippage, while Flow Foundation put the realized amount at approximately $246,000. Blockaid deleted its original post containing the $9.3 million estimate.

The technical root cause was a vulnerability in an Ankr Solidity smart contract rather than Flow EVM or MORE Markets, according to Flow Foundation. The unbacked ankrFLOW created through the vulnerability was subsequently used as collateral on MORE Markets, with E-mode borrowing forming part of the path used to withdraw WFLOW.

MORE Markets has said its smart contracts were not compromised. Flow Foundation also stated that no MORE Markets or ankrFLOW depositor lost funds and no FLOW holder was affected. The Flow network continued operating normally throughout the incident.

Ankr and MORE Markets paused the affected contracts after the incident. Flow Foundation said it would work with Ankr to replace the funds drained from the MORE Markets WFLOW reserve and rebalance affected liquidity pools. AnkrFLOW staking and MORE Markets lending were set to remain paused until Ankr deployed a contract upgrade addressing the vulnerability.

WFLOW is the wrapped representation of FLOW used within Flow EVM, while ankrFLOW is Ankr’s liquid staking token for staked FLOW. In this case, the attacker was able to create ankrFLOW without the corresponding backing before using those tokens as collateral to borrow WFLOW.

Correction: An earlier version of this article reported that approximately $9.3 million was drained from MORE Markets, based on Blockaid’s initial security alert. Blockaid subsequently retracted that estimate and said the 15.5 million WFLOW removed from the reserve was worth approximately $410,000 at spot prices. Flow Foundation also clarified that the underlying vulnerability was in Ankr’s ankrFLOW Solidity contract, not Flow EVM or MORE Markets. The article has been updated to reflect the corrected information.