Balancer responded to the lightning loan attack: had not anticipated the possibility of such an attack and would continue to review the proposal

Balancer, a decentralised trading platform, was reported to have been hit by a lightning loan attack on two liquid mining pools around 2am on June 29, with assets valued at about $500,000, according to BlockBeats. Balancer released its official blog at 9:00 a.m. this morning in response to the news.

Balancer team had a brief recap of the attacks:

1. Lend ETH from dYdX with lightning loan and convert into ETH;

2. Keep trading and STA& NBSP; In each transaction, STA has a transfer fee, which can be saved in the assets that the mining pool hopes to receive;

3. After enough transactions, the attacker calls Gulp (), which synchronizes the token balance calculated in the internal pool into the actual balance stored in the token tracker contract;

4. Since the balance of STA is close to zero and its price is very high relative to other tokens, an attacker can now use STA very cheaply to swap other assets in the pool.

Balancer  Snag said that although it was true that it had not been aware that this particular type of attack was possible, the team has been warning the documentation, discord and other channels about the unexpected effect that ERC20 tokens could have on the transfer fees in the agreement. This is also why STA was not included in the recently merged BAL mining Whitelist. The system was designed for a compatible ERC20, and bad things happen when the coinage works in unexpected ways. Balancer is a protocol that requires no authorization, which means that malicious tokens may be added to an intelligent contract.

Next steps:

• & have spentWe will start adding the transfer fee tag to the UI blacklist, similar to what we did for the no-pool transfer tag. The lists will still be incomplete, however, and any new tokens can be added to Balancer at any time.

• & have spent More documentation will be added on the risks of how these pools work, and how tokens that are corrupted or maliciously designed can drain assets from pools.

• & have spent Balancer has had two complete audits and is planning a third (before today), and Balancer will continue to review and review the program.

The original address: https://medium.com/balancer-protocol/incident-with-non-standard-erc20-deflationary-tokens-95a0f6d46dea

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia