What happened
On August 19, 2023, an attacker drained about 18.35 ETH (about $30,000) from BTC20, an Ethereum token marketed as a "green" version of Bitcoin with staking. Decurity traced the bug to the project's PresaleV4 contract. Its fetchPrice function priced presale purchases with Uniswap's getAmountsIn on the BTC20/WETH V2 pair, so the price came straight from that pair's current reserves. Pool reserves can be moved within a single transaction.
Using flash loans, the attacker pushed borrowed BTC20 into the pair to distort the price. They then bought the presale's entire remaining allotment, 62,516 BTC20, for about 12.2 ETH through buyWithEthDynamic(), and sold everything back into the pools before repaying the loans. Decurity said the attacker had already taken the maximum possible from the contract and that BTC20 was unresponsive in its Telegram chat. According to Cyvers, the attacker had been funded through Tornado Cash.
Attacker: 0x6ce9fa08f139f5e48bc607845e57efe9aa34c9f6
Exploit transaction: 0xcdd93e37ba2991ce02d8ca07bf6563bf5cd5ae801cbbce3dd0babb22e30b2dbe
Attack contract: 0xb7fbf984a50cd7c66e6da3448d68d9f3b7f24f33
How it happened
- The attack contract flash-borrowed 300 WETH from the Balancer Vault, then flash-borrowed about 76,301 BTC20 from the Uniswap V3 SDEX/BTC20 pool and about 47,676 BTC20 from the V3 BTC20/WETH pool.
- It sold about 123,977 BTC20 into the Uniswap V2 BTC20/WETH pair for about 39.09 WETH. This moved the pair's reserves, which PresaleV4's
fetchPricereads throughgetAmountsIn. - It called
buyWithEthDynamic()for the presale's whole remaining allotment, sending 300 ETH. At the manipulated price the presale charged only about 12.195 ETH, which it forwarded to0x5817...9861, refunded about 287.8 ETH, and delivered 62,516 BTC20. - It spent about 40.3 WETH buying back BTC20 on the V2 pair (48,153 and 77,064 BTC20) to repay both V3 flash loans. It sold most of the presale BTC20, 53,585, back into the V2 pair for about 26.04 WETH, and routed the other 8,931 BTC20 through the SDEX/BTC20 V3 pool into SDEX and on to about 5.73 WETH. It then repaid the 300 WETH to Balancer.
- The attack contract kept about 18.348 ETH.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- report Decurity thread on the BTC20 PresaleV4 exploit (via fxtwitter API) twitter.com
- report Cyvers alert on BTC20 (via fxtwitter API) twitter.com
- transaction Etherscan transaction 0xcdd93e37...2dbe etherscan.io
- address etherscan.io address 0x6CE9…C9F6 etherscan.io
- address etherscan.io address 0xb7Fb…4f33 etherscan.io
- analysis DeFiHackLabs PoC BTC20_exp.sol raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
