What happened
On November 6, 2020, an attacker drained about $3.3 million in USDC, USDT and DAI from Cheese Bank, an Ethereum lending protocol, in a single flash-loan transaction. Cheese Bank accepted Uniswap V2 CHEESE-ETH LP tokens as collateral and priced them from on-chain pool state, so pushing ETH into the pool made the collateral look far more valuable than it was. The attacker borrowed 2,068,252.65 USDC, 1,237,995.40 USDT and 87,586.86 DAI against it.
Cheese Bank said the bug had been fixed but kept some features unavailable afterwards. No recovery or compensation was found in the sources reviewed.
Attacker: 0x882d72aaae187f54e85c7a0cb19dfec5316cd9aa
Exploit contract: 0x9e0259437804c7bf175421a451bc80611a0b93c3
Collection address: 0x02b7165d0916e373f0235056a7e6fccdb82d2255
Transaction: 0x600a869aa3a259158310a233b815ff67ca41eab8961a49918c2031297a02f1cc
How it happened
- The exploit contract flash-borrowed 21,000 ETH from dYdX.
- It swapped 50 ETH for about 107k CHEESE on Uniswap V2, added that CHEESE plus 78 ETH as liquidity, and deposited the resulting LP tokens to mint
sUSD_V2collateral in Cheese Bank. - It swapped 20,000 ETH for about 288k CHEESE, flooding the CHEESE-ETH pool with WETH.
- It called
CheesePriceOracle::refresh(). The oracle priced each LP token as the pool's WETH balance x 2 x ETH price, divided by LP supply, so the inflated WETH balance inflated the collateral value. - It borrowed the protocol's entire USDC, USDT and DAI balances through normal
borrow()calls. - It swapped the CHEESE back to about 19.98k ETH and 58k USDC to 132 ETH, repaid the flash loan and sent the stablecoins to the collection address.
Protocol details
Evidence
- report Report cheesebank2020.medium.com
- report @CheeseBank2020 incident report twitter.com
- transaction Etherscan transaction 0x600a869a...f1cc etherscan.io
- address etherscan.io address 02b716…2255 etherscan.io
- analysis Cheese Bank Incident: Root Cause Analysis (PeckShield) peckshield.medium.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis Cheese Bank's multi-million-dollar hack explained by security firm cointelegraph.com
- analysis Strengthening DeFi Security: A Static Analysis Approach to Flash Loan Vulnerabilities arxiv.org
- analysis Nov 2020 - Cheese Bank Heist - $3.3m (Global) quadrigainitiative.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
