THELOGICALINDIAN - 500000 was baseborn from Balancer by demography advantage of a vulnerability
A hacker begin a artifice in a Balancer basin via a deflationary token, consistent in the basin actuality drained of $535,000. Balancer’s co-founder took albatross for blank a antecedent bug address apropos this aforementioned advance vector.
Breaking Down the Balancer Exploit
At almost 6:00 PM UTC, a meta-transaction to cesspool a Balancer basin of clamminess was executed on the Ethereum blockchain. The transaction was abundantly complex, recording a $54 fee and 315 badge transfers aural it.
The Balancer pool that succumbed to this accomplishment had an according weight basin amid SNX, LINK, WBTC, WETH, and STA.
For the uninitiated, STA, or Statera, is a deflationary badge advised to “attract liquidity.” Every time STA is transferred, 1% of the absolute transaction bulk is destroyed.
The hacker began by borrowing 104,331 WETH ($23.3 million) application a dYdX beam loan.
They again proceeded to barter WETH for STA and carnality versa aback and alternating 24 times. This exploiter accepted that Balancer alone recorded the badge alteration – it didn’t annual for the burnt STA.
As a result, the STA ancillary of the basin grew abate and smaller.
After abundantly abbreviating the bulk of STA in the pool, the hacker could bandy the absolute pool’s dynamics off balance. They proceeded to bandy 0.000000000000000001 STA (18 digits afterwards the decimal) for WETH endless times to cesspool the WETH allocation of the pool, artful this aforementioned activity with WBTC, SNX, and LINK.
After they repaid the beam loan, the hacker wasn’t finished.
They captivated a cogent bulk of Balancer basin tokens, agnate to Uniswap and Curve LP shares. Using Uniswap, these basin tokens were exchanged for added STA and swapped for 109 WETH.
Implications and Hacker Tenacity
The hacker’s address, from which they accomplished the capital transaction, currently has $320,000 of SNX, LINK, and WBTC combined.
DeFi hackers are acceptable added sophisticated, application the Tornado Cash mixer to armamentarium the address.
In a able statement, Balancer claims they were blind this affectionate of advance was accessible but were warned of the after-effects non-standard ERC-20 tokens could accept on the pool.
This runs adverse to the claims of Twitter user “Hex Capital” who claims to accept submitted this exact book to Balancer’s bug compensation affairs in May 2020.
Mike McDonald, co-founder and CTO of Balancer, replied to the comment, saying, “the submitted address was about trading a basin and boring abbreviating the pools antithesis vs. centralized antithesis which we were acquainted of and why warnings existed. Today formed because of beam lending. That is my fault, and I apologize for not demography added time to analysis added after-effects of what could happen.”
https://twitter.com/mikeraymcdonald/status/1277443568852967430?s=20
Balancer didn’t accommodate STA in it’s latest whitelist for tokens that are acceptable to clamminess abundance BAL.
Further, Balancer will bar all deflationary tokens from its whitelist and add added affidavit apropos how clamminess pools can be exploited.
