[1/8] Detailed analysis of another bZx/SNX attack (0x762881b07feb63c436dee38edd4ff1f7a74c33091e534af56c9f7d49b5ecac15). This one is more sophisticated than the previous one. The steps are as follows:
[2/8] Step 1. Flash borrow 7,500 ETH on bZx. This is ironic given that bZx will loose at the end
[3/8] Step 2. Exchange 540 ETH through Kyber to sUSD. This goes to Uniswap pushing sUSD value artificially high
[4/8] Step 3. In a series of 18 small 20 ETH transactions exchange another 360 ETH to sUSD. This time Kyber uses its own reserves, pushing sUSD value on them artificially high
[5/8] Step 4. Now get as much sUSD as possible from Synthetics depot. 6,000 ETH is sent there, but there is not enough sUSD in the depot so 943,837 sUSD is taken and 2,482 ETH is returned. Now Synthetics sUSD depot is depleted
[6/8] Step 5. Use all that sUSD (1,099,841) from depot and exchanges to take sUSD collaterlized loan on bZx. As sUSD price is artificially high, bZx is fooled to believe that sUSD collateral is very valuable and gives out 6,796 ETH loan
[7/8] Step 6. Pay back 7,500 ETH loan to bZx.
[8/8] The balance for the attacker is: 7500 - 900 - 6000 + 2482 + 6796 - 7500 = 2378 ETH
All these steps are one atomic transaction. You can see it all clearly thanks to @mierzwik awesome ethtx.info tool: ethtx.info/0x762881b07feb…
