Cellframe Network was attacked by a Hacker, resulting in a $760,000 loss due to a Liquidity migration vulnerability.

robot
Abstract generation in progress

Cellframe Network Encountered Attack: Liquidity Migration Vulnerability Leads to Losses

On June 1, 2023, Cellframe Network suffered a hacker attack on the Binance Smart Chain, resulting in a loss of approximately $76,112. This attack exposed a token quantity calculation issue in the project's Liquidity migration process.

Attack Process Analysis

Hackers carried out a carefully planned attack using flash loans and Liquidity manipulation:

  1. First, obtain 1000 BNB and 500,000 New Cell tokens through a flash loan.

  2. Exchange all New Cell tokens for BNB, causing the amount of BNB in the liquidity pool to approach zero.

  3. Exchange 900 BNB for Old Cell tokens.

  4. Before the attack, the hacker added liquidity of Old Cell and BNB to obtain Old lp.

  5. Call the liquidity migration function. At this point, the new pool has almost no BNB, and the old pool has almost no Old Cell tokens.

  6. During the migration process, due to the lack of Old Cell tokens in the old pool, the BNB obtained from removing liquidity increases, while the Old Cell decreases.

  7. Users only need a small amount of BNB and New Cell to obtain Liquidity, and the excess BNB and Old Cell will be returned to the users.

  8. The attacker removes the liquidity from the new pool and exchanges the returned Old Cell for BNB.

  9. At this time, the Old Cell in the old pool is sufficient but lacks BNB, and the attacker will re-exchange the Old Cell for BNB to make a profit.

  10. Repeat the migration operation to further seize profits.

Web3 Security | Cellframe Network Attacked Due to Manipulation of Pool Ratios by Flash Loans

Web3 Security | Analysis of the Attack Incident on Cellframe Network Due to Flash Loan Manipulation of Pool Ratios

Web3 Security | Cellframe Network Attacked Due to Flash Loan Manipulation of Pool Ratio Analysis

Web3 Security | Cellframe Network Attacked Due to Flash Loan Manipulation of Pool Ratios Analysis

Sources of Attacks and Prevention Suggestions

The root cause of this attack lies in the calculation issues during the liquidity migration process. To prevent similar attacks, the project team should:

  1. When migrating liquidity, consider the changes in the quantities of the two tokens in both the old and new pools as well as the current prices.

  2. Avoid directly using the quantities of the two currencies in the trading pair for calculations, as this can be easily manipulated.

  3. Conduct a comprehensive security audit before the code goes live, with particular attention to key functions involving fund flows.

  4. Establish a real-time monitoring system to promptly detect abnormal trading patterns.

  5. Consider introducing price oracles and other external data sources to obtain more reliable price information.

Web3 Security | Cellframe Network Analysis of Attack Incident Due to Flash Loan Manipulation of Pool Ratios

Web3 Security | Analysis of the Attack Incident on Cellframe Network Due to Flash Loan Manipulation of Pool Ratios

This incident once again emphasizes the importance of security in the design and implementation of complex financial operations in DeFi projects. As the cryptocurrency ecosystem continues to evolve, project teams need to be more vigilant and adopt stricter security measures to protect user assets.

CELL-3.18%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • 7
  • Repost
  • Share
Comment
0/400
zkProofInThePuddingvip
· 08-02 00:46
Another fund has been depleted.
View OriginalReply0
ContractCollectorvip
· 07-30 15:08
Another smart contracts vulnerability, tragic.
View OriginalReply0
ShibaMillionairen'tvip
· 07-30 04:55
It's another Flash Loans trap.
View OriginalReply0
GetRichLeekvip
· 07-30 04:54
Keep going after losing everything
View OriginalReply0
Blockwatcher9000vip
· 07-30 04:54
Another flash loan attack
View OriginalReply0
SeasonedInvestorvip
· 07-30 04:41
Small money is not without meaning
View OriginalReply0
MimiShrimpChipsvip
· 07-30 04:32
Old memories, memories drift with the wind, time passes, things change and people are no longer the same.
View OriginalReply0
Trade Crypto Anywhere Anytime
qrCode
Scan to download Gate app
Community
English
  • 简体中文
  • English
  • Tiếng Việt
  • 繁體中文
  • Español
  • Русский
  • Français (Afrique)
  • Português (Portugal)
  • Bahasa Indonesia
  • 日本語
  • بالعربية
  • Українська
  • Português (Brasil)