Array Finance Hack

The attacker:

https://etherscan.io/address/0x13370353…3604af

The transaction behind the attack:

https://etherscan.io/tx/0xa17bbc7c…bf0daa

The attacker:

- flash loaned DAI, USDC, WETH, WBTC on Aave

- invoked the buy() function of Array Finance. The attacker gained 430 ARRAY tokens minted by Array Finance using 45.91 WETH

- invoked the joinPool() function of a closed source contract (Array Collater - 0xa800cda5…5d190d) five times

- deposited 676,410.58 DAI + 679,080.46 USDC + 901.82 WETH + 20 WBTC + 20 renBTC and gained 726.38 aBPT tokens minted by Array Collater

- invoked the sell() function to burn 430 ARRAY tokens and got 77.17 aBPT tokens

- invoked the exitPool() function of the Array Collater

- burned 804.55 aBPT tokens obtained in previous steps and obtained 748,271.55 DAI + 751,225.08 USDC + 997.62 WETH + 22.63 WBTC + 22.74 renBTC

- repaid the flash loan.

The attacker exploited the vulnerability: the price mechanism of the Array Finance depends on the totalSupply of the aBPT token, which is manipulatable.