WatchPug

Sign in

An economic attack rooted in the design of WUSD

The Exploit

How?

  1. Borrow 16.8M WUSD of flash loan and redeemed into 15M USDT and 106M WEX.
  2. Borrowed 40M USDT of flash loan.
  3. Swapped 518M WEX with USDT. (At a rather cheap price.)
  4. Minted…


The Exploit

How?

  1. Borrowed 24M DAI and 54M MATIC of flash loans from Aave.
  2. Created 25M DAIMATIC LP.
  3. Deposited 10M LP to the DAI-MATIC LP vault. Got the majority share (99%) of the vault.
  4. Deposited 15M LP from the MiniApeV2 contract of ApeSwap to the DAI-MATIC LP vault of ApeRocket (see detailed analysis below).
  5. Called withdrawAll() on the vault.
  6. With the rather large amount of LP token added…


The Exploit

How?

  1. Borrowed 1.6M CAKE ($21.8M) of flash loan from PancakeSwap.
  2. Added 509K CAKE of deposit to the CAKE vault. Got the majority share (99.5%) of the vault.
  3. Sent 1.1M CAKE to the CAKE vault contract.
  4. Called harvest() and getReward() on the CAKE vault.
  5. With the rather large amount of CAKE token in the wallet balance of the vault contract (sent by the hacker at step 3), it returned…


Those who cannot learn from history are doomed to repeat it.

The Exploit

How?


How does Impossible Finance make the impossible possible?

The Exploit

2 swaps at about the same price, which is usually “impossible”

How?

  1. Borrow 233.3 BNB of flash loan from PancakeSwap.
  2. Swapped 65,140 IF token.
  3. Created a FAKE token called AAA (BBB).
  4. Created LP with the FAKE token and IF.
  5. Swapped…


The Exploit

A lot of tokens get minted


Fool me once, shame on you. Fool me twice, shame on me. Fool me three times, shame on both of us.

The Exploit

How?

  1. Added a small sum of deposit to the LINK-BNB Vault (with this transaction).
  2. Send 180 CAKE to the LINK-BNB…


A copycat hack targeted at a copycat platform

The Exploit

How?

  1. Added a small sum of deposit to the SHARK-BNB Vault (with this transaction).
  2. Borrow 100K BNB of flash loan from PancakeSwap.
  3. Swapped 50K BNB into SHARK token and send them alongside the rest 50K BNB to the SharkMinter contract


The Exploit

How?

  1. Added a small number of assets to the Bunny USDT-WBNB Vault (with this tx…

WatchPug

Pug against Rug

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store