Thread by @CertiKAlert

#CommunityAlert 🚨

@ElephantStatus's Treasury contract experienced a #flashloan attack leading to a loss of around $11M. The Treasury contract is unverified and unaudited.

bscscan.com/address/0xd520…

The attacker took advantage of the redeem mechanism of the $TRUNK token, manipulated the price oracle to empower the token return, and stole ELEPHANT from the unverified Treasury contract.

Attack Steps 👇

1. The attacker deployed an attacker contract and borrowed $WBNB and $BUSD using flashloan from multiple pair pools.

2. Most of the borrowed WBNB was swapped for ELEPHANT to raise the price of ELEPHANT.

3. With the raised price, the attacker contract triggered the mint method of the unverified contract (0xd520a3b) of Elephant Money.

4. The attacker contract swapped ELEPHANT for WBNB to reduce ELEPHANT price.

5. With the reduced ELEPHANT price, the attacker contract triggered the redeem method of the unverified contract (0xd520a3b) of Elephant Money.

6. The attacker repeated the process and stole more ELEPHANT from the Treasury contract.

After this, the attacker sold the stolen tokens, repaid the flashloan, and withdrew the profit from the attacker contract.