Easy to understand in 5 steps: How to use DeFi loopholes to make a profit of 360,000 US dollars
Recently, a "hacker" used Flash Loan with almost zero cost. See Note 1 for details] The loan provided earned 360,000 US dollars in one transaction (there is still a lot of controversy about whether this incident belongs to the category of "hacking attack", because technically speaking, this " Hacker" did nothing illegal). Considering the number of DeFi products involved in this "cracking" incident, if you want to make it easy for those who have only a preliminary understanding of DeFi, you must explain the relevant details as clearly as possible. In this article, I will walk the reader step-by-step through the "crack" operation, and give further explanations in some key steps. So that you can have a deeper understanding and understanding of how this incident happened, instead of just "knowing a little bit".
text
Step 1: FlashLoan loan: borrow 10,000 WETH from dydx.
text
text
Step 3: dZx Margin Leverage Trading: 1300 WETH recharged to dZx contract, 5 times leverage to short. The specific operation can be simply understood as borrowing 5637.623762 WETH from bZx and selling it in Uniswap through KyberSwap, and selling it becomes 51.345576 WBTC.
This step is actually to break through the price of WETH/WBTC in Uniswap.
At that time, the normal price of WETH/WBTC was about 0.025974, and this step of selling basically dropped the price of WETH/WBTC in Uniswap to 0.00910747. nearly three times.
text
Step 4: Uniswap transaction: Use the 112 BTC borrowed from Compound in step 2 to buy back ETH in Uniswap, and buy back a total of 6871.4127388 ETH.
text
Step 5: FlashLoan returns: There are 3200 WETH unused in the 10000 WETH lent by FlashLoan, plus the 6871 WETH bought back with 112 WBTC in step 4, a total of 10071.4127388 WETH. 10000 WETH for Flash Loan return. There are 71.4127388 remaining.
At this point, the whole operation is over.
As long as these transactions occur within one block time of Ethereum and are packaged and confirmed by the next block of Ethereum, these transactions will be executed according to the time of initiation. Key point: Since the conditions of the Flash Loan are met and returned within one block, the transactions of the entire steps can be realized.
So let's take a look at Joe's earnings:
From these 5 steps, it looks like Joe only got 71.4127388 WETH.
But don't forget: Joe still has two positions in Compound and bZx.
The first one is mortgage lending in Compound. Mortgaged 5500 WETH and lent 112 WBTC.
The other is margin leveraged trading in bZx, where 1300 WETH is mortgaged and sold short with 5 times leverage. There are 51.345576 WBTC remaining.
Because bZx uses the WETH/WBTC price in Uniswap as the price feed, and the WETH/WBTC price in Uniswap is manipulated by Joe. Therefore, according to conventional understanding, Joe's position in bZx should be liquidated. But the actual situation is that there is only 51.345576 WBTC obtained in the third step operation left in this position.
Joe obviously didn't want to ignore this position. Even if the remaining 51.345576 WBTC is deducted. (In fact, bZx did deduct the 51.345576 WBTC.)
As for positions in Compound, Joe is more interested. According to the normal price of ETH/BTC at this time is about 0.025974, Joe only needs to spend 4300 WETH from the market to buy 112 WBTC. Then return it to Compound, and you can redeem 5500 WETH. This can earn about 1200 WETH.
Therefore, Joe's profit in this operation should be:
1200+ 71.4127388 = 1271.4127388 WETH。
secondary title
So what is the problem?
Based on the detailed steps above, the problem lies in bZx's margin leveraged trading smart contract.
First of all, bZx uses the price of WETH/WBTC in Uniswap as the feed price. And the depth in Uniswap is not enough.
Secondly, the margin leveraged trading in bZx, regardless of long or short, the market for buying or selling is also Uniswap. In other words, bZx itself will have an impact on the price of Uniswap.
postscript:
postscript:
The purpose of this article is not to criticize the vulnerabilities of any DeFi products after the incident, or to criticize the hacker we call Joe.
The purpose of this article is only to allow more ordinary participants in the cryptocurrency field to have a further understanding of the logic of DeFi products, and it is as simple and understandable as possible.
At the same time, I also hope that everyone can see what the root cause of this incident is, and developers should also learn from it when designing other DeFi products.
To further sublimate, this incident has actually aroused discussions in the DeFi field about whether or not to set up so-called "administrator permissions" for DeFi products. This article serves as an introduction, and we can continue to share this kind of content with the Cortex Chinese community in the future.
CortexLabs Note 1: Flash Loan, the Chinese literal translation name is Flash Loan. "Flash loan" is a method of initiating multiple transactions on different DeFi lending platforms within one block, that is, re-loaning between different assets and debts. "Flash Loan" is also a loan method that does not require collateral, provided that the issuance and repayment of the loan must be completed in the same block of Ethereum. According to the current block production speed of Ethereum, it takes about 13 seconds.
