CertiK: The insurance company that sold the accident insurance also suffered an accident? Cover Protocol Vulnerability Analysis

The main attack is divided into the following steps:

① Provided a total of 2,573 DAI liquidity to the Balancer Pool

②The attacker obtained approximately 132,688 Balancer liquidity proof tokens BPT by providing liquidity to the Balancer Pool

Figure 1: The deposit() function in blacksmith.sol

By calling the deposit function, the attacker pledges the obtained BPT liquidity proof to the cover protocol.

First read the pool data of the current liquidity proof token to memory through line 118 in Figure 1, and then call line 121 to update the data of the current pool.

Next, as shown in line 318 in Figure 3, deposit() casts a certain number of cover tokens to the function caller (msg.sender) by calling the _claimCoverRewards() function.

The number of minted cover tokens is related to the three variables pool.accRewardsPerToken, CAL_MULTIPLIER and miner.rewardWriteoff.

Please note that the value of pool.accRewardsPerToken here uses the pool data stored in memory, not the updated value using the update() function in Figure 2.

At the same time, it is known from the deposit function in Figure 1 that the value update of miner.rewardWriteoff occurs after the execution of the _claimCoverRewards() function is completed.

Therefore, in the original design, the updated value of miner.rewardWriteoff should be used to calculate the number of cover tokens that need to be minted. Here, the unupdated data of miner.rewardWriteoff is incorrectly used, resulting in the actual number of minted cover tokens being greater than the number of minted tokens. The number increased, which eventually led to the issuance of tokens.

After the pledge is successful, the attacker calls the withdraw() function in the blacksmith.sol smart contract to retrieve the pledged BPT and obtain additional minted cover tokens to complete the attack.

By comparing the token balance table after executing the deposit() function and the withdraw() function, we can find that after calling this set of deposit and withdraw functions, the attacker can obtain about 704 COVER tokens.

After deposit():

After withdraw():

After the attack, as of press time, the official cover has migrated blacksmith to a safe version:

Vulnerable blacksmith address:

0xe0b94a7bb45dd905c79bb1992c9879f40f1caed5

Blacksmith address after temporary fix:

0x1d5fab8a0e88020309e52b77b9c8edf63c519a26

The temporarily repaired blacksmith contract temporarily prohibits all pledge and withdrawal operations to prevent the attacker from continuing to attack.

In this attack, the attacker made a total profit of 4.4 million U.S. dollars, or about 29 million yuan.

There are other attackers using this vulnerability to launch similar attacks. For example, the Grap.finance project official participated in the attack using this vulnerability and earned 4350 ETH tokens.

safety advice