Smart Contract Exploits in April

Ocean Life   |  Amount Lost: $11K

The Ocean Life Token on the BNB chain has been exploited for $11K. The attacker initially borrowed wrapped BNB using flash loans and swapped these funds to get $OLIFE tokens. The exploit contract had a vulnerability where the total balance state did not get updated internally before an external call was made. The private reflectFee function had decreased the total value to 969 WBNB worth of OLIFE tokens. However, the balance of the pool did not get updated correctly and the attacker was able to swap 1,001 WBNB and make a profit of 34 WBNB.

Hundred Finance   |  Amount Lost: $7M

An attack on Hundred Finance resulted in a loss of $7M. The hacker used flash loans and donated 500 WBTC to Hundred Finance's CErc20 Contract, with the intention to manipulate the exchange rate of Hundred WBTC (hWBTC). The attack contract deposited the WBTC funds into child contracts, which are utilized to mint hWBTC.

Subsequently, the child contract redeemed nearly all of the WBTC funds, except for 2 wei, causing the total supply of hWBTC to be 2 wei. The attacker then donated 500 WBTC to Hundred's CErc20 Contract, which inflated the exchange rate to nearly 1 wei hWBTC = 250 WBTC.

Taking advantage of this inflated rate, the attacker borrowed 1022 WETH with 2 wei of underlying assets. After borrowing the WETH funds, the attacker was able to withdraw the 500 WBTC that was previously donated to Hundred's CErc20 Contract due to a rounding error, and eventually repaid the flash loan.

Yearn Finance   |  Amount Lost: $11M

Yield Finance suffered an exploit this morning, resulting in losses potentially over $11 million due to a misconfiguration in its yUSDT contract. The attacker flash loaned DAI, USDC, and USDT and used some of the funds to repay other people's debts on the Aave v1 Lending Pool, lowering the priority of the Aave pool within the Yearn contract.

The Yearn contract contained a hard-coded lender contract address for Fulcrum which used iUSDC as the underlying asset instead of iUSDT. This caused the Yield contract to miscalculate the yield-to-deposit ratio. The attacker was able to mint an excessive amount of yUSDT by depositing a small amount of USDT. The attacker then swapped yUSDT to DAI and ETH.

Metapoint   |  Amount Lost: $920K

MetaPoint on BNB Chain suffered a $920K hack due to a vulnerability in their deposit contract function. The exploit happened because every time a user deposited $POT to the pool, a new smart contract was generated, and $META tokens were deposited to it. The new smart contract had a public approve function that allowed unrestricted access to the deposited tokens, enabling the attacker to drain them. MetaPoint team announced the hack and suspended all operations.

Paribus   |  Amount Lost: $20K

An attack on Paribus resulted in the loss of approximately $20,000. The attacker borrowed 200 ETH and 30,000 USDT using a flash loan and deposited the tokens into the Paribus protocol. The deposited funds were used as collateral to borrow additional ETH from the pETH pool. The attacker exploited a reentrancy vulnerability during the pToken redeems function. According to the Paribus Post-Mortem update, the non-reentrant modifier failed to update the storage prior to the transfer. The attacker was able to borrow additional funds while the deposited pETH balance remained unchanged.

Interested in learning more about Olympix?

Olympix is a paradigm shift in Web3 protection. It offers proactive detection, enabling you to identify and prioritize smart contract vulnerabilities while you code. Its intuitive nature makes security an integral part of the development process, with security-first thinking embedded at every stage.

Here are some links to get you started:

https://www.olympix.ai/ - Our website where you can sign up to join our Beta / Discord https://twitter.com/Olympix_ai - Get updates on exploits, product updates

https://tinyurl.com/3fwyhpub - April 25 Newsletter, subscribe for more