Channels Finance Hack

Reported loss $320K
BNB Chain
Infinite Mint

What happened

On 30 December 2023, Channels Finance, a lending protocol on BNB Chain built on an old Compound V2 codebase, lost about $320,000. SlowMist says the contracts carried a known Compound V2 vulnerability. The DeFiHackLabs reproduction shows an exchange-rate inflation (donation) attack on the cCLP_BTCB_BUSD market, which took PancakeSwap BTCB-BUSD LP tokens as collateral.

The attacker first shrank that market's cToken supply. Then, using flash-loaned BTCB and BUSD, they minted LP tokens and transferred them straight into the market contract, which inflated the value of their few cTokens. Treating that as collateral, the attacker borrowed all available cash from Channels' other markets (WBNB, BUSD, USDT, USDC, DAI, ETH and BTCB).

A rounding error in redeemUnderlying then let them withdraw the donated LP tokens while giving up almost no cTokens. The attack took two transactions from attacker address 0x20395d8e8a11cfd2541b942afdb810b7dcc64681.

How it happened

  1. In the first transaction, the attacker's contract 0x07e536f23a197f6fb76f42ad01ac2bcdc3bf738e reduced the cCLP_BTCB_BUSD market's total supply to a tiny number of cTokens, which set up the exchange-rate manipulation.
  2. In the second transaction (0x93372ce9c86a25f1477b0c3068e745b5b829d5b58025bb1ab234230d3473b776), the attacker flash-loaned BTCB and 500,000 BUSD from PancakeSwap V3 pools and minted BTCB-BUSD LP tokens.
  3. The attacker transferred those LP tokens straight to the cCLP_BTCB_BUSD contract without minting cTokens, so each of the few remaining cTokens appeared to be worth a huge amount of collateral.
  4. After entering all markets, the attacker borrowed the entire cash balance of the WBNB, BUSD, USDT, USDC, DAI, ETH and BTCB markets against that inflated collateral.
  5. The attacker called redeemUnderlying for almost all of the market's cash. Because of rounding, this burned roughly one cToken, so the donated LP tokens came back out. The attacker then burned the LP, repaid the flash loans and kept the borrowed assets.

Protocol details

Classification Token & Share Accounting
Protocol Type Lending
Implementation language Solidity
Protocol links @ChannelsFinance

Security review history

Evidence

Same attack technique

Browse all hacks →
BNB Chain MAP Protocol $110K lost Ethereum Barley Finance $130K lost Acala Acala Loss not disclosed Tron TronCrush Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes