Another DeFi attack, a replay of Flurry Finance

Source: Certik wechat official account

Flurry Finance Theft: A Case in Point

On February 22, 2022 at 1:46 PM Beijing time, CertiK's team of security experts detected a series of suspicious activity related to Flurry Finance, where Flurry Finance's Vault contract was compromised and approximately $293,000 worth of assets were stolen.

Below, the CertiK security team will explain and analyze the contract address and attack operation in detail.

Attack steps

攻击者部署了一个恶意 Token 合约（也被用作攻击合约），并为 Token 和 BUSD 创建了一个 PancakeSwap 交易对。

The attacker:

https://bscscan.com/address/0x0f3c0c6277ba049b6c3f4f3e71d677b923298b35

恶意 Token 合约：

https://bscscan.com/address/0xb7a740d67c78bbb81741ea588db99fbb1c22dfb7

PancakeSwap transaction pair:

https://bscscan.com/address/0xca9596e8936aa8e902ad7ac4bb1d76fbc95e88bb

The attacker lightning loans from Rabbit's Bank contract and triggers the StrategyLiquidate execute method.

execute 方法将输入数据解码为 LP Token 地址，并进一步得到恶意 Token 合约地址。

攻击者利用恶意 Token 合约中的攻击代码发起初步攻击：

https://bscscan.com/address/0xbeeb9d4ca070d34c014230bafdfb2ad44a110142

StrategyLiquiddate contract:

https://bscscan.com/address/0x5085c49828b0b8e69bae99d96a8e0fcf0a033369

恶意 Token 合约调用 FlurryRebaseUpkeep 合约的 performUpkeep 方法，对 Vault 合约的相关金额进行重新统计，并更新了与之相关的 Rho Token 的 multiplier。

此处的 multiplier 将用于 Rho Token 的余额计算。对 Vault 合约的相关金额进行重新统计，并更新了与之相关的 Rho Token 的 multiplier。此处的 multiplier 将用于 Rho Token 的余额计算。该更新基于与 Vault 合约相关的盈利策略合约里的余额。

The update is triggered in the flash loan process. At this time, the flash loan has not been completed and the amount lent has not been returned, so the current balance of the Bank contract is far less than the normal value. This Bank contract is also a part of a strategy, so the balance of a strategy is smaller than the normal value, which further results in a smaller multiplier than the normal value.

FlurryRebaseUpkeep contract:

https://bscscan.com/address/0x10f2c0d32803c03fc5d792ad3c19e17cd72ad68b

One of Vault's contracts:

https://bscscan.com/address/0xec7fa7a14887c9cac12f9a16256c50c15dada5c4

The attacker returned the money from the Lightning loan and completed the initial attack, and was ready to profit from further attacks.

在紧接着的交易中，攻击者以前一次交易中得到的低 multiplier 存入 Token ，将 multiplier 更新为更高的（正常）值，并以高 multiplier 提取 Token 。例如，在其中一笔初步攻击的交易中，multiplier 被更新为 4.1598e35。

The Multiplier was updated to 4.2530E35 on further attacks.

Attack instance:

https://bscscan.com/tx/0x923ea05dbe63217e5d680b90a4e72d5552ade9e4c3889694888a2c0c1174d830

https://bscscan.com/tx/0x646890dd8569f6a5728e637e0a5704b9ce8b5251e0c486df3c8d52005bec52df

因为 multiplier 乘数是决定 Rho Token 余额的因素之一：

攻击者的 Rho Token 余额在交易中增加了，所以 ta 能够从 Vault 中提取更多的 Token 。 

Attackers repeated this process several times, stealing $293,000 worth of assets from Vault contracts.

Write in the last

This event is mainly caused by external dependencies.

CertiK's security experts therefore recommend that projects have a clear understanding of the security of external contracts before interacting with them, and limit the impact that external dependencies may have on their own contracts.

The warning of this incident has been in the first time.CertiK official Twitter accountBroadcast.

In addition to that,CertiK websiteCommunity alert has been added. On the website, you can see community alerts about vulnerabilities, hacks, and Rug pulls.

With the recent high incidence of attacks, encryption project parties and users should enhance their vigilance and timely improve and audit the contract code.

In addition, technical teams should pay attention to security incidents that have occurred and check for similar problems in their own projects.

As a leader in blockchain security, CertiK is committed to raising the level of security and transparency for cryptocurrencies and DeFi. To date, CertiK has secured approval from 2,500 enterprise clients, protecting more than $311 billion in digital assets from losses.

The original link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia