Third thing you need to read today
Yesterday was a crazy day. The @Balancer hack shook the entire community. Many analyses emerged, but unfortunately, some missed the point of what's most important at a time like this and why such analyses are being done.
User safety and helping projects should ALWAYS be our first priority. As usual, @SEAL led the way, but we know that many other good people also abandoned their current tasks to analyze fixes and consult on strategies with affected teams.
Analyzing the root cause of a hack shouldn't be about gaining as many followers as possible because you were the first to write about it. The point is to share information responsibly. Firstly, to limit losses, and secondly, to prevent these kinds of vectors in the future.
Was it a re-entrancy ?
No, there was no a callback and no user data specified in the swap data.
Was it an access control issue?
No, the attacker was executing operations on his behalf.
The root cause was that ...
1️⃣ The attacker used a pool with 3 tokens: A, B and the POOL token itself.
2️⃣ Swapped a lot of POOL token for a lot of A and B: transfer in POOL and transfer out A and B. The balances of A and B are *small*, while balance of POOL is *huge* (see the balances picture).
3️⃣ Make swaps back from A and B to POOL. All swaps are "exact amount out" swaps and the "amount in" is calculated. However, the swaps from A/B to POOL drop the POOL token from balances when calculating amount in.
🚨 The effect: to get a big amount of POOL (to return the pool back to the initial state) the attacker needs to transfer in a small amount of A/B, because the amount is calculated based on small amounts of A and B only (POOL is excluded from the calculation).
As you can see, it was not a trivial attack, and removing this vulnerability is not easy either. The straightforward recommendation would be not to exclude POOL token from the invariant, but I bet there was business logic reason for that.
Final thoughts:
➡️ Multi token pools are tricky. Especially those that have its own token in it.
➡️ Any changes to invariants calculations are super important to check carefully.
Inflating and resulting balances (point 1):
Attack (point 3):
1,41k
3
Innholdet på denne siden er levert av tredjeparter. Med mindre annet er oppgitt, er ikke OKX forfatteren av de siterte artikkelen(e) og krever ingen opphavsrett til materialet. Innholdet er kun gitt for informasjonsformål og representerer ikke synspunktene til OKX. Det er ikke ment å være en anbefaling av noe slag og bør ikke betraktes som investeringsråd eller en oppfordring om å kjøpe eller selge digitale aktiva. I den grad generativ AI brukes til å gi sammendrag eller annen informasjon, kan slikt AI-generert innhold være unøyaktig eller inkonsekvent. Vennligst les den koblede artikkelen for mer detaljer og informasjon. OKX er ikke ansvarlig for innhold som er vert på tredjeparts nettsteder. Beholdning av digitale aktiva, inkludert stablecoins og NFT-er, innebærer en høy grad av risiko og kan svinge mye. Du bør nøye vurdere om handel eller innehav av digitale aktiva passer for deg i lys av din økonomiske tilstand.