Array Finance Hack

The attacker:

Address 0x1337…04af

The transaction behind the attack:

Tx 0xa17b…0daa

The attacker:

• Flash loaned DAI, USDC, WETH, WBTC on Aave
• Invoked the buy() function of Array Finance. The attacker gained 430 ARRAY tokens minted by Array Finance using 45.91 WETH
• Invoked the joinPool() function of a closed source contract (Array Collater - 0xa800cda5…5d190d) five times
• Deposited 676,410.58 DAI + 679,080.46 USDC + 901.82 WETH + 20 WBTC + 20 renBTC and gained 726.38 aBPT tokens minted by Array Collater
• Invoked the sell() function to burn 430 ARRAY tokens and got 77.17 aBPT tokens
• Invoked the exitPool() function of the Array Collater
• Burned 804.55 aBPT tokens obtained in previous steps and obtained 748,271.55 DAI + 751,225.08 USDC + 997.62 WETH + 22.63 WBTC + 22.74 renBTC
• Repaid the flash loan.

The attacker exploited the vulnerability: the price mechanism of the Array Finance depends on the totalSupply of the aBPT token, which is manipulatable.