Orcus Finance incident
Dear community,
The Orcus Finance EOA hot wallet that provided liquidity into the ORU/USDC pair was hijacked.
A malicious program hacked the personal computer of the contract deployer. Personal funds and some funds from the protocol were withdrawn, which affected the price of the ORU token. oUSD is unaffected due to algorithms and price protection. The liquidity in oUSD/USDC pair is unaffected.
The hacker’s wallet:
https://blockscout.com/astar/address/0x7bD1ed3aDF588A89c392c5c424583C0FfFfCe145/transactions
The problem solution
1. The hacker now doesn’t have any ORU tokens, all the contracts’ ownership was transferred to the new address. New contracts’ owner:
https://blockscout.com/astar/address/0x779497A66fc99f5aB2c9218c542C3540c0eA7e9A/transactions
Ownership transferred:
https://blockscout.com/astar/tx/0xa0f30007140f0c1c16aaeb92e3e0604b499346c2623bd7e242d15a45e2b7a001/internal-transactions
2. Multisig wallet will be added to the ownership once Gnosis Safe will be live on Astar.
3. Orcus Vaults will be released on the next day, and fees from the vaults will be used daily to push the ORU price up back.
4. Rewards from pools ORU/USDC and ORU/oUSD are disabled for a while until the situation will be solved.
5. oUSD/USDC pair received lower reward distribution, the current one is 0.5 ORU per second.
6. In such a case we have provided reserved funds to buyback token from the market to stabilize pair reserves, activity can be tracked here:
https://debank.com/profile/0x779497a66fc99f5ab2c9218c542c3540c0ea7e9a/history
Deeply sorry for that, contracts remain safe and unaffected.
Contracts are secured and the hacker doesn’t have access to the wallet anymore, he also has no tokens. We will keep updating the community concerning further steps and the whole situation.
Tomorrow, Orcus Vaults will be released and more liquidity will be provided. Please follow official announcements.
