Impossible Finance exploit root cause analysis

The Exploit

2 swaps at about the same price, which is usually “impossible”

How?

  1. Borrow 233.3 BNB of flash loan from PancakeSwap.
  2. Swapped 65,140 IF token.
  3. Created a FAKE token called AAA (BBB).
  4. Created LP with the FAKE token and IF.
  5. Swapped 32,570 IF into 221,898 BUSD and another 32,570 IF into 221,898 BUSD using IF router thru the FAKE token LP.
  6. Repeated the steps from 3 to 5.
  7. Sold 556,384 BUSD for 1,731 BNB, repaid the flash loan.

The Root Cause

Missing the “K” check

About Us

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store