A decimal point caused millions of dollars to evaporate, Fantasm Finance attack analysis
picture
At 21:50 on March 9, 2022, Beijing time, the CertiK security expert team detected that the Fantasm Finance mortgage pool was maliciously used.
Below, the CertiK security team will give you a detailed interpretation and analysis from the aspects of contract addresses and attack operations.
first level title
https://ftmscan.com/tx/0x64da8b8043b14fe93f7ab55cc56ccca2d190a59836a3f45dbb4b0a832e329cac
https://ftmscan.com/tx/0xa84d216a1915e154d868e66080c00a665b12dab1dae2862289f5236b70ec2ad9
attack steps
attack steps
①The attacker deployed an unverified contract at address 0x944b58c9b3b49487005cead0ac5d71c857749e3e.
②In the first tx, the attacker exchanged Fantom tokens (FTM) for FSM tokens, and called the mint() function in contract 0x880672ab1d46d987e5d663fc7476cd8df3c9f937.
first level title
Vulnerability analysis
Vulnerability analysis
_xftmOut = (_fantasmIn * _fantasmPrice * COLLATERAL_RATIO_MAX * (PRECISION - mintingFee)) / PRECISION / (COLLATERAL_RATIO_MAX - collateralRatio) / PRICE_PRECISION。
first level title
whereabouts of funds
first level title
write at the end
write at the end
This incident was mainly caused by a calculation error in the contract formula.
When people mention vulnerabilities in the encryption world, they tend to think that vulnerabilities must be very complicated, but this is not always the case. Sometimes a small miscalculation can cause millions of dollars in assets to evaporate overnight.
The early warning of this event was broadcast on the CertiK project early warning Twitter【https://twitter.com/CertiKAlert】.
The early warning of this event was broadcast on the CertiK project early warning Twitter【https://twitter.com/CertiKAlert】.
In addition, the technical team should pay attention to the security incidents that have occurred in a timely manner, and check whether similar problems exist in their own projects.
In addition, the technical team should pay attention to the security incidents that have occurred in a timely manner, and check whether similar problems exist in their own projects.
Reference link:
1. https://blocksecteam.medium.com/the-analysis-of-the-array-finance-security-incident-bcab555326c1
2. https://peckshield.medium.com/xwin-finance-incident-root-cause-analysis-71d0820e6bc1
3. https://peckshield.medium.com/pancakebunny-incident-root-cause-analysis-7099f413cc9b
4. https://www.certik.io/blog/technology/copycat-attack-balancer-why-defi-needs-change#home
5. https://www.certik.org/blog/uranium-finance-exploit-technical-analysis
6. https://www.certik.io/blog/technology/little-pains-great-gains-balancer-defi-contract-was-drained#home
7. https://www.certik.io/blog/technology/yam-finance-smart-contract-bug-analysis-future-prevention#home
