Tweet

PeckShield Inc.

4 Aug, 6 tweets, 3 min read

@Wault_Finance

1/5
@Wault_Finance was exploited to extract about $888K “profit” for the attacker (370 ETH). Here is the related tx: bscscan.com/tx/0x31262f15a…

2/5
The hack is similar to an earlier yDAI hack: the stake() function has a flaw that can be forced to swap from USDT to WEX via the related USDT_WEX pair, even when the pair has been manipulated to be highly imbalanced. peckshield.medium.com/the-ydai-incid…

3/5
In the exploit, the hacker makes the first flashloan of 16M WUSD (and redeems the WUSD to 15M USDT and 106M WEX), then the second flashloan of another 40M USDT, and swaps 23M USDT to 518M WEX, resulting in an imbalanced USDT_WEX pair.

4/5
The attacker repeats stake() 68 times. Each time the WUSDMaster is coded (forced) to swap 10% of the staked USDT (250K) into WEX via the imbalanced USDT_WEX pair, which becomes even skewed. At the end, the attacker makes a reverse swap from WEX to USDT for profit.

@BinanceChain

5/5
Overall, the attacker makes a profit of 370.19 ETH (~$888K), which is immediately transferred from @BinanceChain to @ethereum (0xf9E3D08196F76f5078882d98941b71C0884BEa52) via @Anyswap. We are actively monitoring this address for any movement.

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @peckshield

PeckShield Inc.

@peckshield

4 Aug

1/4
SorbettoFragola was exploited in etherscan.io/tx/0xcd7dae143…, resulting in the loss of about $20.7M including 2.6K WETH, 5.4M USDC, 5M USDT, 160K DAI,10K UNI, and 96 WBTC.

2/4
The hack was due to the lack of proper fee accounting when LP tokens are transferred. Specifically, the attacker creates three contracts A, B, and C and repeats in the sequences of A.deposit(), A.transfer(B), B.collectFees(), B.transfer(C), C.collectFees() for eight pools.

3/4
In the exploit, this hack is initialized from this attacker address (located at 0xf9e3) and works as follows:
Step 1: Flashloan 30M USDT, 13K WETH, 1.4KBTC, 30M USDC, 3M DAI and 200K UNI from Aave. And attack eight PLP pools. Below we take the USDT-WETH pool as an example.

Read 4 tweets