DeFi Attack | Our monitoring system reported that EGD_Finance was attacked (bscscan.com/tx/0x50da0b1b6…), and the loss is around 36,044 USDT.
This is a typical price manipulation attack.
#DeFi #BSC #CryptoSecurity
This is a typical price manipulation attack.
#DeFi #BSC #CryptoSecurity
2/ The process of attack:
1)Flashloan from
Pool1: 2,000 BUSD-T
Pool2: 424,456 BUSD-T
Pool1: Pancake Pool BUSD-T/WBNB
Pool2: Pancake Pool **EGD**/BUSD-T
1)Flashloan from
Pool1: 2,000 BUSD-T
Pool2: 424,456 BUSD-T
Pool1: Pancake Pool BUSD-T/WBNB
Pool2: Pancake Pool **EGD**/BUSD-T
3/ The process of attack:
2) EGD_Finance.claimAllReward()
=> EGD_Finance transfers --- 5,614,105 EGD ---> Mal Contract
Mal Contract: 0xC30808D9373093fBFCEc9e026457C6a9DaB706a7
Attacker: 0xee0221D76504Aec40f63ad7e36855EEbF5eA5EDd
2) EGD_Finance.claimAllReward()
=> EGD_Finance transfers --- 5,614,105 EGD ---> Mal Contract
Mal Contract: 0xC30808D9373093fBFCEc9e026457C6a9DaB706a7
Attacker: 0xee0221D76504Aec40f63ad7e36855EEbF5eA5EDd
4/ The Vulnerability
EGD_Finance.claimAllReward depends on the balance ratio of Pool2.
The method of calculating the reward token EGD depends on the ratio of the balance in the pair of USDT and EGD, so the attacker can manipulate the amount of the reward by flashloan.
EGD_Finance.claimAllReward depends on the balance ratio of Pool2.
The method of calculating the reward token EGD depends on the ratio of the balance in the pair of USDT and EGD, so the attacker can manipulate the amount of the reward by flashloan.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
