SlowMist: Eldel Finance loses approximately $350,000 in attack incident

CoinFeed July 1 news, according to SlowMist alert, Eldel Finance suffered an attack with a loss of approximately $350,000. The root cause of the vulnerability is that the latestAnswer() function in the price source reads the convertToAssets() of the ERC4626 vault, and the vault's totalAssets() directly uses the underlying asset balance, allowing attackers to manipulate the price by directly transferring donated assets. The attacker used a flash loan combined with a donation attack to manipulate the oracle price, stealing approximately $350,000 and some reserve funds from the Aave Pool. The attacker address is 0x58428161bb55c14a413945f06cbdec157f411c76, and affected contracts include the price source and the ERC4626 vault.