Partnered With:

Lightning loan is actually just a tool

Read this article in 10 Minutes

In the past month, there have been 46 prominent security incidents in the whole blockchain ecosystem

The original title: "Misread Flash Loans: It's Just a Tool."

Source: Peckshield

According to data from the Peckshield situational awareness platform, there have been 46 prominent security incidents across the blockchain ecosystem in the past month. There were 25 DeFi related cases, 4 exchange related cases, 3 extortion related cases, 10 fraud cases, 2 wallet related cases, and 2 smart contract related cases.

According to Peckshield's statistics, in May 2021, a total of 23 DEFI related security incidents occurred, with a loss of about $280 million, including about 11 lightning loan attacks and 15 DEFI related security incidents on the BSC chain. Three on the Ethereum chain and one on EOS.

Frequent lightning loan attacks, from last year's Ethereum transferred to this year's hot BSC, many people will "lightning loan" interpreted as "the source of evil", "built on the nuclear bomb on the DeFi", "the attacker empty handed white Wolf's principal".

In fact, these remarks are a misinterpretation of flash lending, which uses blockchain technology to bring new possibilities that are not possible in the traditional lending market. In theory, flash lending allows users to lend out all the tokens in the liquidity pool without collateral, requiring them to return the borrowed tokens and a fixed borrowing cost after a series of swap-mortgage clearing operations but before the transaction is closed.

The first flash loan attack in the BSC was on May 2, when Peckshield "PaiShield" traced and analyzed the DeFi protocol.Spartan Potocol Hit by lightning loan attack. After that, the frequency of lightning loan attacks appeared on the BSC chain increased, including PancakeBunny,Bogged Finance,AutoShark,BurgerSwapAnd JulSwap.

According to Peckshield's observations, these lightning lending attacks are similar to those on Ethereum, only transferred from Ethereum to BSC. At the beginning of the year, BSC attracted a number of DEFI protocols on the original Ethereum and the DEFI protocols on the Fork Ethereum by virtue of its low commission fee and fast block production speed. The ecology of DEFI is increasingly rich, and the assets bound to BSC are also increasing, which also makes it a "harvest field" for attackers to look down on.

From the above six cases of lightning loan attacks, we find that most of the attacks are very similar to the previous attacks on Ethereum.

Burgerswap is similar to OUSD's attack tactics. BurgerSwap based on BSC and on Ethereum & NBSP;OUSD "Lightning credit + reentrant attack" is similar in that the attacker first loans a Lightning credit from the decentralized exchange that provides lightning exchange, and then stores fake coins and native tokens (Burger, OUSD) in the smart contract. In this step, the attacker attacks the contract through reentrant attack, and finally returns the Lightning credit to complete the attack.

The Lightning Lend attack that controls Curve Ypool reappears on BSC. On May 30, BSC chain combined with AMM agreement Belt Finance multi-strategy income optimization was lightning loan attack, Peckshield "Shield" through tracking and analysis found that the attack originated from the attacker through repeated buying and selling BUSD, Manipulate the price of BeltBusd to profit by taking advantage of the loophole in the calculation of BellipsisBusd policy balance.

It is worth noting that Ellipsis is a project authorized by Defi protocol Curve on Ethereum to Fork, and the arbitrage event of manipulating the price of Curve Ypool many times to catch the price difference of stable currency has recurred. Has the Pandora's box of Fork Curve been opened?

To sum up, these reoccurring lightning attacks are all tractable, and not without defences.

According to the security officer of Peckshield: "Protocol developers should not only understand Fork's Defi protocol, but also understand their own protocol. The LELego nature of the protocol is not simple Mosaic, but the combination is based on a complete understanding of the logic behind the original protocol. At present, there are not no solutions to the lightning loan attack. Have to do is to do static audit before agreement online, exclude known vulnerabilities; when other protocols have been attacked, self checking code, rule out homologous holes; the previous case, dynamic audit on a regular basis, to avoid vulnerability. In addition to enlist the help of a professional code audit team, still need to introduce a third party security threat perception and data situational intelligence service, Develop your defenses. When an attack occurs, make sure you are aware of it and take prompt action."