Stolen $30 million, the first flash loan attack on the BSC chain

Send a shield

Original title: "BSC's first lightning loan attack, how DeFi lego take the tack?"

In DEFI's world, with the help of smart contracts, the barriers for individuals to create financial products are dramatically lowered. People can design their own financial products freely according to their own needs, and realize convenient transactions through combination.

At present, with the increasingly rich combination of DEFI protocols, a large number of "monetary Lego" protocols have emerged, from the original decentralized exchange Uniswap in the Ethereum ecosystem, to the second-generation evolutionary version Sushiswap, and then to Pancakeswap in the BinanceSmart Chain ecosystem. But the risks in the process of combination are also gradually highlighted.

On May 2, DEFI protocol Spartan Potocol was hacked, Peckshield "Peckshield" through tracking and analysis found that Spartan Potocol   Hit by flash loan attack, loss 30 million dollars.

The Spartan Protocol is an asset liquidity program designed to address problems with existing AMM protocols and synthetic assets. The liquidity pool of Sparta protocol is the core of this protocol, and all related applications in the system cannot be supported without the liquidity pool. Spartanswap applied Thorchain's AMM algorithm. This algorithm uses liquidity-sensitive fee to solve the Liquidity cold start and slip point problems.

Here is the attack:

First the attacker lent 10,000 WBNBs from a PancakeSwap;

Second, the attackers exchanged WBNB for Spartan in five separate transactions in the compromised Spartan exchange pool, 1913172761985767 216 WBNB respectively for the california-based SPARTA 621865037511887481 851 california-based SPARTA, 555430671132761862 228, California-based SPARTA 499085759479401386 321, 450888746281107956 525 california-based SPARTA, and 409342991605563291 439 california-based SPARTA. The attacker hand from 2536613206010720978 364 california-based SPARTA and 11853332387003677 468 WBNB, attackers will provide liquidity, these Tokens injection flow in the pool Casting out 933350959915078264 802 tokens (SPT1 - WBNB);

Third, the attackers used the same technique to exchange WBNB into Spartan ten times in the compromised exchange pool, 1674025291112046 314 WBNB respectively for the california-based SPARTA 711, 336553226465441691, 316580407374988368, 081, california-based SPARTA, 298333475508824463 21 california-based SPARTA, california-based SPARTA 281619236447865739 95, 266270782882243349 121 california-based SPARTA, 252143313619354185 874 california-based SPARTA, california-based SPARTA 239110715436216587 616, 227062743868374362 627 california-based SPARTA, California-based SPARTA 883, 215902679015937989 and 205545395655623012 643 california-based SPARTA, a total of 2639121977274869750 716 california-based SPARTA.

The fourth step, the attacker will 21632147559269186 481 WBNB and all of the california-based SPARTA, namely the three steps above of & have spent 2639121977274869750, 716, california-based SPARTA flow into the pool, to prop up asset prices.

Fifth, burned from the second step of 933350959915078264 802 tokens (SPT1 - WBNB), back liquidity, due to the flow cell is in a state of inflation, A total of 224 WBNB burned 2538199153135885179, california-based SPARTA, 986, and 20694059682261067, it is important to note that in the second step, Attacker to exchange 11853332387003677 only 468 WBNB, a profit of 9000 WBNB attackers;

Step 6, the attacker in the fourth step into 1414010159080880295 494 pool token to provide liquidity to flow pool, Then start burning mechanism for 2643882074128460308 86 WBNB california-based SPARTA 497 and 21555697892154369.

Attacker share liquidity function called calcLiquidityShare () query the current balance, and manipulation of the balance of arbitrage, the correct operation to use baseAmountPooled/tokenAmountPooled state.

The DeFi system needs to be supported by a smart contract, which requires the smart contract code to be carefully reviewed. If there are any holes in a smart contract, it could become a target for hackers.

Under the traditional conditions, hackers attack the financial system mainly by virtue of their advantages in computer technology. However, under the existing DEFI ecology, because the interoperability between various chains and applications is not so good, there may be a greater probability of arbitrage between different chains and applications. At this point, even a person with not so strong computer skills, as long as he has enough financial knowledge and enough market sense, can also become a hacker to attack the DEFI system.

Hackers borrow large sums of money at a very small cost through flash loans on the blockchain, and then use this money to cause the price fluctuation of some digital assets and profit from it. Initially originated in Ethereum, hackers are also waiting for their chance as the ecological assets of Cefi + Defi, such as Binancen smart chain, become more and more abundant.

"Defi developers should review their code after an attack has occurred. If they are not aware of this, they should consult a professional auditor to conduct an audit and study to prevent future attacks," Peckshield said in a statement.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia