jakiro
Source: Shenzhen Zero -time Technology
background
Monitor the chain attack event against DualPools:
https://bscscan.com/tx/0x90F374CA33FBD5AAA0d01f5FCF5Dee4C7AF49A98B47459D8B7AD52EF1E93
DualPools (https://dualPools.com) is based on Venusprotocol (https://venus.io/). It is a DEFI project that provides services such as SWAP, Lend, BORROW and other services.
The operation mode is as shown below:
DualPools is a decentralized lending platform. The user stores the corresponding DTOKEN through DEPOSTI to deposit UnderlyingasSETS (assets). On the contrary, when the UnderlyingAssets are removed through Redeem, the corresponding DTOKEN is destroyed.
Among them, the exchange ratio of UnderlyingAsSETS and DTOKEN is controlled by Exchange. In short, ExchangeTe is the value of DTOKEN.
exchangerate = (TotalCash + Totalborrows -TotalReserves) / TotalSupply
Attack analysis
Simply put, the attack is divided into two parts:
1. Hackers Insufficient liquidity (0) through DualPools’ new trading pool, which greatly raises the price of DLINK, and hollows out the target assets of other trading pools through BORROW (WBNB, BTCB, ETA, Ada, BUSD).
2. Utilize the problem of precision cutting to retrieve all the LINKs invested in the early stage.
Step 1 Detailed analysis
The attacker borrowed through the Dodo Private Pool and Pancakeswapv3 and obtained BNB and BUSD as the initial attack fund, as shown below:
Subsequently, BNB and BUSD were mortred via Venusprotocol and borrowed 11500 link to attack DualPools.
First of all, the attacker obtained the DLINK of 2 minimum units through the re-trading pool Dlink-Link Mint, and then transferred to the Link of the units of 11499999999999999999999999999 to the trading pool.
Since the trading pool is not initialized, there is no liquidity.And the calculation method of exchangerate is as follows:
exchangerate = (TotalCash + Totalborrows -TotalReserves) / TotalSupply
At this time, TotalCash was the balance of Link in the trading pool, 11499999999999999998+2 = 115000000000000000000, Totalborrows and TOTALRESERVES were 0, and TotalSupply was 2 (because the hacker obtained two minimum minimum singles via Mint DLINK).Therefore, at this time the Exchangeate was 57500000000000000000 (575 times the value of Dlink).Because the attacker owns the 2 DLINK, and the value is high enough, the hacker borrowed 50 BNB, 0.17 BTCB, 3.99 Eth, 6378 Ada, 911 BUSD through BORROW.
Step 2 Detailed analysis
The attacker converted the two previous Mint’s two minimum units DLINK to 1149999999999999999898 through the Redeemunderlying.Because the Exchangeterate was manipulated at 57500000000000000000.Therefore, the DLINK required to exchange 11499999999999999999999898 The DLINK required is 11499999999999999988 /5750000000000000000000 = 1.9999999999999, which is 1.9999999. Deceleration causes DLINK only one of the smallest units.
At this point, the attacker took out the LINK of 11499999999999999999999898.Subsequently, the borrowing of Venusprotocol, Pancakeswapv3, Dodo Private Pool will be returned to complete the attack.
Summarize
The attacker uses the reason for the poor liquidity of the new trading pool of DualPools. The Exchange of the bid’s assets causes the DTOKEN price distortion corresponding to the target asset, which can use a small DTOKEN as a mortgage to borrow a large number of other target assets.Subsequently, the interception of the intelligent contract removal method was used to retrieve the assets invested when the previous attack.So far, complete attack on DEFI project DualPools.
