Technical Analysis of the DeFi platform Balancer under Hacker Attack

Recently, a DeFi platform that has gained attention due to its "lending is mining" model suffered a hacker attack. The attacker exploited vulnerabilities in the two ERC20 deflationary token pools, STA and STONK, resulting in losses of over $500,000.

After analysis by security experts, it was found that the root of the problem lies in the incompatibility between the deflationary tokens on the platform and their smart contracts under certain conditions. This allows attackers to create liquidity pools with price deviations and profit from them.

The attack process is mainly divided into four steps:

1. The attacker obtained a large amount of WETH as a flash loan from a lending platform.

2. The attacker repeatedly executes the swapexactMountin() call until most of the STA tokens held by the target platform are exhausted, preparing for the next step of the attack.

3. By exploiting the incompatibility between the STA token and smart contracts, specifically the mismatch of accounting and balances, the attacker successfully drained other assets from the liquidity pool, ultimately profiting over $520,000.

4. The attacker repaid the flash loan and transferred the digital assets obtained from the attack.

In the second step of the attack, the attacker cleverly caused the platform to have only a minimal amount of STA left, which led to an abnormal increase in the value of STA. Subsequently, the attacker exploited the fee mechanism during the token transfer, resulting in a mismatch between the actual amount of STA received by the platform and the internal accounting.

By repeatedly calling the gulp() function to reset the internal accounting, the attacker was able to continuously exchange a small amount of STA for a large amount of other assets until depleting the assets in the liquidity pool such as WETH, SNX, LINK.

This incident once again exposed the compatibility risks inherent in the composability of DeFi. To prevent similar attacks, it is recommended:

1. When the amount of a deflationary token is insufficient to pay the transaction fee during a transfer, it should be directly rolled back or return False.

2. Decentralized Finance platform should check the actual balance after each transferFrom() function call.

Moreover, DeFi project developers should adopt good coding standards and conduct comprehensive security testing before launch. At the same time, it is also crucial to conduct thorough compatibility checks for various token standards and the combinatorial behavior of DeFi projects.

The attack resulted in losses of approximately $523,000, involving various digital assets. This will undoubtedly impact the entire Decentralized Finance ecosystem and serves as a reminder for developers to pay close attention to the security of smart contracts. With the rapid development of the DeFi sector, similar security incidents may continue to occur, making it especially important to strengthen security awareness and technical prevention.