Third thing you need to read today
Yesterday was a crazy day. The @Balancer hack shook the entire community. Many analyses emerged, but unfortunately, some missed the point of what's most important at a time like this and why such analyses are being done.
User safety and helping projects should ALWAYS be our first priority. As usual, @SEAL led the way, but we know that many other good people also abandoned their current tasks to analyze fixes and consult on strategies with affected teams.
Analyzing the root cause of a hack shouldn't be about gaining as many followers as possible because you were the first to write about it. The point is to share information responsibly. Firstly, to limit losses, and secondly, to prevent these kinds of vectors in the future.
Was it a re-entrancy ?
No, there was no a callback and no user data specified in the swap data.
Was it an access control issue?
No, the attacker was executing operations on his behalf.
The root cause was that ...
1️⃣ The attacker used a pool with 3 tokens: A, B and the POOL token itself.
2️⃣ Swapped a lot of POOL token for a lot of A and B: transfer in POOL and transfer out A and B. The balances of A and B are *small*, while balance of POOL is *huge* (see the balances picture).
3️⃣ Make swaps back from A and B to POOL. All swaps are "exact amount out" swaps and the "amount in" is calculated. However, the swaps from A/B to POOL drop the POOL token from balances when calculating amount in.
🚨 The effect: to get a big amount of POOL (to return the pool back to the initial state) the attacker needs to transfer in a small amount of A/B, because the amount is calculated based on small amounts of A and B only (POOL is excluded from the calculation).
As you can see, it was not a trivial attack, and removing this vulnerability is not easy either. The straightforward recommendation would be not to exclude POOL token from the invariant, but I bet there was business logic reason for that.
Final thoughts:
➡️ Multi token pools are tricky. Especially those that have its own token in it.
➡️ Any changes to invariants calculations are super important to check carefully.
Inflating and resulting balances (point 1):
Attack (point 3):
1,14 K
3
Conținutul de pe această pagină este furnizat de terți. Dacă nu se menționează altfel, OKX nu este autorul articolului citat și nu revendică niciun drept intelectual pentru materiale. Conținutul este furnizat doar pentru informare și nu reprezintă opinia OKX. Nu este furnizat pentru a fi o susținere de nicio natură și nu trebuie să fie considerat un sfat de investiție sau o solicitare de a cumpăra sau vinde active digitale. În măsura în care AI-ul de generare este utilizat pentru a furniza rezumate sau alte informații, astfel de conținut generat de AI poate să fie inexact sau neconsecvent. Citiți articolul asociat pentru mai multe detalii și informații. OKX nu răspunde pentru conținutul găzduit pe pagini terțe. Deținerile de active digitale, inclusiv criptomonedele stabile și NFT-urile, prezintă un grad ridicat de risc și pot fluctua semnificativ. Trebuie să analizați cu atenție dacă tranzacționarea sau deținerea de active digitale este adecvată pentru dumneavoastră prin prisma situației dumneavoastră financiare.