GoPlus: Suspected "project management address hacked" led to Ribbon Finance being attacked

Deep Tide TechFlow News, December 15th, the GoPlus Chinese community posted on social media analyzing the principles behind the attack on the decentralized options protocol Ribbon Finance.

The attacker upgraded the price oracle contract at address 0x657CDE to a malicious implementation contract, then set the expiration times for four tokens—stETH, Aave, PAXG, and LINK—to December 12, 2025, 16:00:00 (UTC+8) and tampered with the expiration prices to profit from the attack.

It is worth noting that when the project contract was created, the _transferOwnership status of the attacker’s address was already set to true, allowing it to pass the contract security checks. Analysis shows that this attacker’s address was likely one of the project’s management addresses initially, but was later controlled by hackers through social engineering attacks and other means to carry out this attack.