If you are interested in the details on the recent bZx arb/attack trade, have a look at ethtx.info/0xb5c8bd9430b6… - the following thread is a step-by-step explanation of what is going on
First the attacker gets 10,000 ETH loan from dYdX (SoloMargin.operate with ActionType=1 which is withdraw). Note that there is also ActionType=8 which is a call. In this case it is a call to attacker's script
Then he sends 5,500 ETH to Compound and gets 112 WBTC loan (cETH.mint and cWBTC.borrow)
Then he sends 1,300 ETH to Fulcrum/bZX to short WBTC. Fulcrum borrows additional 4337 ETH from bZx lenders and buys on Uniswap (through Kyber) 51.34 WETH causing temporary massive WBTC price spike
Now, attacker sells 112 WBTC on Uniswap taking advantage of this spike and gets 6,871 ETH in return
Last step is a repayment of 10,000 ETH loan from dYdX. So, with 6,871 gained and 5,500 and 1,3000 attacker nets 71 ETH, 61 of which is immediately taken as part of the contract distraction. What he is left with as well are some Fulcrum short tokens that he bought for 1,300 ETH
People focus on bZx, but maybe more problematic are massive Uniswap price swings that made it all possible ?
[errata] - bZx buys 51 WBTC on Uniswap, not WETH obviously :)
[errata2] on bZx the bought tokens are to short ETH, not BTC
The balance should also include open Compound position which after the trade is 5,500 ETH deposited and 112 WBTC borrowed
And it is this position that is slowly being liquidated for real profit as anyone can see here: etherscan.io/address/0x4f4e…
