Blueberry, a lending and leverage protocol in the decentralized finance (DeFi) space, has taken swift action to mitigate potential damage after discovering an exploit. Users have been advised to withdraw their funds while the protocol addresses the situation.
The Blueberry Protocol Foundation announced on February 23 that it had detected an ongoing exploit within its protocol. As a precaution, users were urged to withdraw their funds from Blueberry’s lending markets while the team worked on pausing the protocol to prevent further exploitation.
Shortly after identifying the exploit, users faced difficulties withdrawing their funds as the platform’s front end went offline. Blueberry acknowledged these issues and encouraged users who could interact directly with the contracts to proceed with withdrawals.
Approximately 30 minutes later, Blueberry successfully paused the protocol, bringing stability back to the platform. The website and app resumed functionality, allowing users to access their accounts. In an update, Blueberry assured users that their deposited funds were no longer exploitable, relieving the chaos.
Further updates from Blueberry revealed that a white hat individual, c0ffeebabe.eth, had secured the drained funds and returned 366 ETH to the Blueberry multi-signature wallet. The protocol team emphasized that only a small portion of the funds remained unrecovered, and efforts were underway to contact the validator responsible for the loss of 91 ETH.
The exploit attempt had an impact on Blueberry’s Total Value Locked (TVL), which decreased from $4.5 million to $3.15 million. Blueberry, a protocol forked from the Compound DeFi protocol, faced scrutiny as users questioned the effectiveness of its security measures.
The incident raised concerns about the reliability of Blueberry’s security protocols, despite claims of a security-first approach to development and risk mitigation. The protocol had previously undergone audits from Hacken and Sherlock, as well as independent token security audits.
However, a tweet promoting a recent “security overview” mysteriously disappeared from Blueberry’s feed, leading to speculation about the protocol’s transparency and accountability.