Today's @CrediX_fi hack is due to compromised admin account 0xF321683831Be16eeD74dfA58b02a37483cEC662e, which has a number of roles, including POOL_ADMIN, BRIDGE, ASSET_LISTING_ADMIN, EMERGENCY_ADMIN, and RISK_ADMIN.
And the BRIDGE role is abused to drain/borrow pool assets with the estimated loss of $4.5m, including the mint of unbacked acUSDC tokens (Credix Market Sonic USDC).
Our analysis shows that the @meta_pool staking contract has a critical bug that allows for free mint of mpETH.
This specific tx freely mints 9700+ mpETH ($27m), but the low-liquidity of mpETH limits the profit to ~10 ETH.
It seems @Convergence_fi was just exploited (w/ ~$210k loss) to mint 58m $CVG (58,718,395.05681812), which are swapped to 60 WETH and 15.9k crvFRAX.
The bug is part of the CvxRewardDistributor contract, which does not validate the (untrusted) user input to claim rewards.
Here is the hack tx: