Harvest was attacked, 20 ETH arbitrage 24 million US dollars, but CRV rose

Editor's Note: This article comes fromChatting with Xiaozha (ID: xiaonazha88), reprinted by Odaily with authorization.

Editor's Note: This article comes from

Chatting with Xiaozha (ID: xiaonazha88)

, reprinted by Odaily with authorization.

A major event yesterday was that Harvest was hacked, or an economic attack, and hackers stole $24 million.

I originally used stablecoins to participate in mining, in order to seek a stable income, but now it’s all right, and the principal is lost.

secondary title

1. The process of Harvest being attacked

First, many Harvest users said that their fusdt deposited in Harvest lost about 10% of their principal, and then the Harvest official website released information about the attack.

Regarding the lightning attack on Harvest, the SlowMist Security Team’s brief analysis of the incident is as follows:

amount.mul(totalSupply()).div(underlyingBalanceWithInvestment());

1. The attacker transfers 20ETH through Tornado.cash as a subsequent attack fee;

2. The attacker lent a huge amount of USDC and USDT through UniswapV2 flash loan;

3. The attacker first uses the exchange_underlying function of Curve to exchange USDT for USDC. At this time, the investedUnderlyingBalance in the Curve yUSDC pool will be correspondingly smaller;

4. Then the attacker recharges a huge amount of USDC into the Vault through the deposit of Harvest. At the same time of recharging, the Vault of Harvest will mint fUSDC, and the minted amount is calculated as follows:

The underlyingBalanceWithInvestment part of the calculation method takes the value of investedUnderlyingBalance in Curve, because the change of investedUnderlyingBalance in Curve will cause Vault to mint more fUSDC;

6. In the end, you only need to return fUSDC to the Vault to get more USDC than when you recharged.

7. The attacker then begins to repeat the process for continued profit.

Summary: This attack is mainly due to the fToken (fUSDC, fUSDT...) of Harvest Finance using the quotation in the Curve y pool (that is, using Curve as the price feed source) when minting coins, so that the attacker can manipulate the oracle through a huge amount of exchange The price of the machine is used to control the minting amount of fToken in Harvest Finance, thus making the attacker profitable.

Simplify the process of hacking Harvest: first use USDC to increase the price of USDT -> deposit fUSD -> then exchange USDT back to USDC to balance the premium -> fUSD back to USDT, the above process is repeated and arbitraged.

secondary title

2. DeFi arbitrage can be described as a huge profit

Hackers attack Harvest through flash loans, what are the pay and benefits?

Cost: 20 ETH;

Tool: flash loan;

20 ETH was used to fight for 24 million US dollars, and then anonymous coin laundering and other operations were performed through the renbtc channel.

text

text

Wolves are natural scavengers. Then this flash loan should be the scavenger of the DeFi protocol, professionally cleaning up the problems in the protocol.

There is also a problem highlighted here. The threshold for DeFi projects is really high. When ICO, a white paper can go out to fudge financing and issue coins, etc., and then fork a code, modify it, and launch the mainnet.

Of course, DeFi can also be forked, such as cream, various food mining, etc., based on the mature model, with a slight modification. But if you want to be a little innovative, or the story sounds fuller, you can't do it without technical strength and economic design strength.

secondary title