Tweet

PeckShield Inc.

2 Oct, 5 tweets, 3 min read

@AutoSharkFin

1/x @AutoSharkFin The swap mining feature was exploited in a flurry of txs to gain the reward of 3.18M FINS tokens, which are then immediately swapped to 1,388 BNB (with roughly $581K).

2/x The hack is made possible due to the relatively low pool liquidity so that the hacker can use flashloans to occupy the majority of pool share (to recover swap loss/fee) while still enjoy the sizable "swap fee reward” (increased from each huge swap).

3/x To illustrate, we use one example hack tx (bscscan.com/tx/0x640ce34ce…) with 100+ swaps back-and-forth to get 15K FINS rewards, which are then swapped to get 121 BNB as profit. Note the swap fee is still largely obtained by the hacker due to the owned majority pool share.

@TyphoonCrypto

4/x The hacker repeats the above steps seven times and gains in total 1,388 BNBs (with ~$580K). The initial hack funds are transferred from @TyphoonCrypto and the final gains are transferred out to Ethereum via @AnyswapNetwork.

@AutoSharkFin

Interesting, it seems the @AutoSharkFin platform charges 0.3% swap fees with a portion being sent to holders of #FINS as dividends. The hacker sold native tokens for ~$581k, while the platform gained ~$920k for buyback and fees redistribution.

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @peckshield

PeckShield Inc.

@peckshield

30 Aug

@CreamFinance

1/4 @CreamFinance was exploited in (one hack tx: etherscan.io/tx/0xa9a1b8ea2…), leading to the gain of ~$18.8M for the hacker.

2/4 The hack is made possible due to a reentrancy bug introduced by $AMP, which is an ERC777-like token and exploited to re-borrow assets during its transfer before updating the first borrow.

3/4 Specifically, in the example tx, the hacker makes a flashloan of 500 ETH and deposit the funds as collateral. Then the hacker borrows 19M $AMP and makes use of the reentrancy bug to re-borrow 355 ETH inside $AMP token transfer(). Then the hacker self-liquidates the borrow.

Read 4 tweets

PeckShield Inc.

@peckshield

4 Aug

@Wault_Finance

1/5
@Wault_Finance was exploited to extract about $888K “profit” for the attacker (370 ETH). Here is the related tx: bscscan.com/tx/0x31262f15a…

2/5
The hack is similar to an earlier yDAI hack: the stake() function has a flaw that can be forced to swap from USDT to WEX via the related USDT_WEX pair, even when the pair has been manipulated to be highly imbalanced. peckshield.medium.com/the-ydai-incid…

3/5
In the exploit, the hacker makes the first flashloan of 16M WUSD (and redeems the WUSD to 15M USDT and 106M WEX), then the second flashloan of another 40M USDT, and swaps 23M USDT to 518M WEX, resulting in an imbalanced USDT_WEX pair.

Read 6 tweets

PeckShield Inc.

@peckshield

4 Aug

1/4
SorbettoFragola was exploited in etherscan.io/tx/0xcd7dae143…, resulting in the loss of about $20.7M including 2.6K WETH, 5.4M USDC, 5M USDT, 160K DAI,10K UNI, and 96 WBTC.

2/4
The hack was due to the lack of proper fee accounting when LP tokens are transferred. Specifically, the attacker creates three contracts A, B, and C and repeats in the sequences of A.deposit(), A.transfer(B), B.collectFees(), B.transfer(C), C.collectFees() for eight pools.

3/4
In the exploit, this hack is initialized from this attacker address (located at 0xf9e3) and works as follows:
Step 1: Flashloan 30M USDT, 13K WETH, 1.4KBTC, 30M USDC, 3M DAI and 200K UNI from Aave. And attack eight PLP pools. Below we take the USDT-WETH pool as an example.

Read 4 tweets