Partnered With:

Peckshield: Replied Merlin Labs lightning loan attack, lost 240ETH

Read this article in 7 Minutes

After the attacker completes the attack, he converts them to ETH in batches across the chain bridge through Nerve (AnySwap).

原文标题：《又一打脸现场！Fork Bunny 的 Merlin 损失 240 ETH》

Original source: Peckshield

The genie is out of the bottle? We analyzed the principle of the lightning credit attacks of Pancakebunny and Autoshark and the on-chain transfer records of the attackers, and found some clues of the same origin attack of Merlin Labs.

On May 20, 2021, a group of unknown attackers raised the value of LP tokens by calling the function getReward() to receive an additional Bunny reward worth $45 million. On May 25, PeckShield's "PaiShield" alert discovered that Fork Pancakebunny's revenue aggregator AutoShark Finance had been hacked by Pancakebunny's same source lightning loans.

On May 26, 2021, just 24 hours after the AutoShark Finance attack, Peckshield "PieShield" security personnel dissected the principles of the PancakeBunny and AutoShark attacks and the attacker's on-chain transfer records, Merlin Labs that found Fork PancakeBunny suffered a homologous attack.

All three of these attacks had two similar characteristics,Attackers targeted Fork Pancakebunny's revenue aggregator; After the attacker completes the attack, he converts them to ETH in batches across the chain bridge through Nerve (AnySwap).

Interestingly, after the Pancakebunny attack, Merlin Labs also posted that Merlin took extra precautions for potential possibilities by checking for vulnerabilities in the Bunny attack and constantly reviewing code that was repeatedly executed in detail. In addition, the Merlin development team has come up with a solution for this type of attack to prevent similar incidents from happening to Merlin. At the same time, Merlin stresses that user safety is their top priority.

However, Bunny's misfortune is repeated by Merlin. Merlin says it's positioned as a challenger to Bunny. Unfortunately, Merlin's magic never escaped the curse of Bunny.

Peckshield: A brief description of the attack process:

This time, instead of borrowing the lightning loan as the principal, the attacker deposits a small amount of BNB into Pancakeswap for liquidity mining and gets the corresponding LP Token. Merlin's smart contract is responsible for transferring the attacker's assets into Pancakeswap to get the CAKE reward. Cake rewards are directly transferred to the Cake pool for the next round of compound interest; The attacker calls getReward() function, which is the same as Bunny's vulnerability. Cack is injected in large quantities, so that the attacker can get a large number of Merlin rewards. The attacker repeats the operation, and finally gets 49,000 Merlin rewards.

The attacker then converts them to ETH in batches via Nerve (AnySwp) across the chain bridge, and Peckshield's anti-money laundering situational awareness system Coinholmes continuously monitors the dynamics of the transferred assets.

Peckshield: Fork Pancakebunny's Defi protocol must be careful to check if there are similar vulnerabilities in your contract, or get a professional auditor to prevent and monitor similar attacks so that you don't become the next "unlucky one".

In this wave of BSC DEFI, if DEFI developers do not pay more attention to security, they will not only put the ecological security of BSC at risk, but will also become the enemy of attackers.

Pancakebunny's successive copycat attacks show that attackers don't need high technical or financial barriers, and can make a fortune by patiently repeating the same vulnerabilities on Fork Bunny's Defi protocol. Fork's Defi protocol may not have even become a Bunny challenger, but it lost so much because of the homologous bug that it was derided as "a leek field of stubbornness".

There are two types of "games" in the world, the "finite game" and the "infinite game". The finite game is to win; the infinite game is to keep the game going forever.

No doubt the attackers' infinite game will continue, whether or not Fork Bunny's Defi protocol takes a serious look at its code.