BSC platform this week the fourth attack: Belt Finance was attacked process analysis

Belt Finance Attack: Pandora's Box Open for Fork Curve?

  Original source:   Send shield & have spent PeckShield   

Beijing time on May 30, Peckshield "Shield" warning shows that the BSC chain combined with multi-strategy income optimization AMM Belt Finance agreement was lightning loan attack.

Through tracking and analysis, Peckshield "PayShield" found that this attack originated from the fact that the attacker manipulated the price of BeltBusd for profit by repeatedly buying and selling Busd and taking advantage of the loophole in the balance calculation of BellipsisBusd policy.

Interestingly, Ellipsis is the project of the Defi protocol Curve licensing Fork on Ethereum. Given the past Curve-related attacks, is Pandora's box being opened again?

Here is the attack:

In the first step, an attacker makes eight flash loans from a PancakeSwap:

FLIP WBNB-BUSD: 107,736,995.2 BUSD & NBSP;

FLIP USDC-BUSD: 38,227,899.2BusD & NBSP;

Flip busdt-busd: 153,621,552.7 BUSD & NBSP;

Flip Dai-Busd: 31,372,406.8 Busd & NBSP;

FLIP-BUSD: 17,505,135.1 BUSD & NBSP;

Flip Vai-Busd: 17,294,888.2 Busd & NBSP;

Flip Alpaca-Busd: 10,828,766.5 Busd & NBSP;

Flip Cake-Busd: 10,728,353.2 Busd & NBSP;

Put 10 million of them in the bellipsisBusd policy;

The second step is to deposit 187 million BUSDs into the BvenusBusd strategy, and then convert 190 million BUSDs into 169 million USDT through the Ellipsis contract.

Repeat the lift-swap-charge operation for 7 times: the attacker extracts more BUSDs from the policy BvenusBusd, converts 190 million BUSDs into 169 million USdt through the Ellipsis contract, and stores the BUSD into the BvenusBusd policy.

Since the price of beltBUSD depends on the sum of the balances of all machine gun pools, the attacker stores BUSD into the bVenusBUSD policy and then raises BUSD. In theory, since the number of assets remains the same, the attacker will not make a profit even if the operation is repeated many times. However, if other strategies are manipulated, Beltbusd's price will be affected.

In this attack, the attacker manipulated the price by buying and selling BUSD multiple times and taking advantage of a hole in the calculation of the Bellipsis policy balance.

The attacker then converts the captured assets to ETH in batch by batch through Nerve (AnySWAP) across the chain bridge, and the Peckshield's anti-money laundering situational awareness system Coinholmes continuously monitors the changes.

This is the fourth security incident on the BSC chain this week. This week, we've been alerting and analyzing security incidents on Fork Pancakebunny and Uniswap. Attacks on the BSC chain are accelerating and increasing. Is there another attack by the Ethereum Defi attackers or are new copycat attacks already on the rise?

As attacks accelerate, the entire security infrastructure of the DEFI field deserves to be re-examined. Attackers are looking at more than just a new star. PeckShield advises the Defi protocol for Fork Curve to self-inspect the code to eliminate such vulnerabilities, or to seek the help of a professional code audit team before you lose money.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia