BiSwap Hack

On June 30, 2023, attackers drained about $865,000 from Biswap liquidity providers through the MigratorV3 contract, which Biswap had deployed days earlier to move liquidity from its V2 pools to V3. The migrator trusted the pair and token addresses supplied by the caller: it did not check that token0 and token1 matched the real V2 LP pair. Attackers mixed fake tokens and fake pair contracts with victims' real LP positions, so the migrator burned victims' V2 LP tokens (for users who had approved it) and routed the underlying assets into positions and refunds the attacker controlled.

MetaTrust's analysis of one attacker's transactions names 0xA1E31B29f94296FC85FAC8739511360f279B1976 as the attacker, 0x1d448e9661c5abfc732ea81330c6439b0aa449b5 as the attacking contract and 0x839b0afd0a0528ea184448e890cbaaffd99c1dbf as the targeted migrator. DeFiHackLabs' reproduction of that wave uses attack transaction 0xebe5248820241d8de80bcf66f4f1bfaaca62962824efaaa662db84bd27f5e47e. Proceeds were converted to BNB and sent through Tornado Cash.

CertiK noted the migrator was outside the scope of its earlier Biswap audits. Biswap said it took responsibility and fully compensated affected users in July 2023.