Partnered With:

Aperocket: A Multi-Chain Lightning Loan Attack

Read this article in 8 Minutes

Aperocket, a revenue aggregator with a layout on the BSC and Polygon chains, was hit by lightning loans in less than 12 hours.

原文标题：《收益聚合器 Aperocket 多链闪电贷攻击的「困」与「破」》

原文来源： PeckShield

On July 14, Aperocket, a revenue aggregator based on the BSC and Polygon chains, was hit by lightning loans in less than 12 hours.

According to PeckShield's tracking and location-based analysis, the two attacks were based on a revenue-inflation loophole in Aperocket, although the attackers used different techniques.

After the attack on Aperocket on the BSC chain, the price of Aperocket's token Space briefly dropped 75%.

Aperocket is a revenue aggregator for a Pancakebunny that "forked" after a flash loan attack that triggered a series of flash loan attack dominoes.

Users receive automatic compound benefits by pledging APESWAP's LP Token, Cake, or Space tokens.

In this security event, the attacker pledges a CAKE and receives a CAKE reward and a SPACE token reward (an additional reward for Aperocket), using an AutoCake: withdrawing all ()& NBSP; Profit from existing loopholes.

Peckshield describes the attack process on the BSC chain:

First, the attacker made two flash loans from Pancakeswap, totaling 1.615 million Cakes;

Then 509,000 Cakes are entered into the pool. This step helps the pool cast SPACE tokens when an attacker calls a later withdrawing All() or earned() function in the AutoCake contract;

Since the first attacker pledged a large amount of Cake to the pool, this rapidly increased its shareholding in the pool, allowing it to split more than 90% of the AutoCake pledge proceeds, namely Cake and Space;

After the preliminary work was completed and Cake was deposited into the capital pool, the attacker made the second transaction, which pledged 1105 thousand Cakes to the AutoCake contract and called Harvest function in the AutoCake contract to trigger re-casting, which is equivalent to the nesting child version of the Cake compound interest pool. Pledge Cake, you can dig Cake, contract and then automatically pledge the obtained Cake to the Cake capital pool.

As the number of Cakes counted in the contract grows, so does the number of Spaces forged.

In the end, the attackers returned the Lightning loan for a profit of 883.5 BNB ($273,000). According to Peckshield, the attacker made about $1 million on Polygon.

Since the first quarter of 2021, the DEFI market has shown a trend of multi-chain ecological spurt, with the overall market continuing its strong growth momentum in the second half of 2020, with most indicators hitting all-time highs.

However, as the virtual currency market pulled back in the latter part of the second quarter, the Defi area was more or less affected. The public chain in the scramble for liquidity at the same time, the existing DEFI agreement is also exploring and adapt to the emerging mode of operation - multi-chain layout.

The considerable rate of return helps to attract liquidity, but at the same time, the multi-chain layout also puts forward higher requirements for the security of the protocol and the speed of security response. When security incident occurs, not only need to screen the first time has been attacked by vulnerabilities, security scheme is put forward, at the same time to find the underlying vulnerabilities on a chain, for the first time to check the other one or more agreement on the chain if there is a similar problem, and timely warning community, put forward security solutions, avoid the associated marketable assets exposure in risk, Helps to reduce the known, may cause a greater loss.

In the offensive and defensive battles with attackers in the first half of this year, Peckshield "PieShield" found that the establishment of risk control circuit breaker mechanism, the introduction of the third party security company's situational awareness intelligence service, the first time to respond to security risks, timely troubleshooting and blocking security attacks, can effectively reduce the losses caused by lightning credit attacks.

With the rise of chain deployment, in dealing with a security event, participants require agreement, professional security team than the attackers more calm, this is a time of war, the attacker will not stop. Let us reflection only has compared to the attacker to first one step, even a small step, are likely to become our phased victory in the battle for a big step.