What happened
DAFI Protocol lost value in the ChainSwap cross-chain bridge exploit of July 11, 2021 (UTC), when an attacker minted and sold bridged tokens belonging to more than 20 projects that used ChainSwap. DAFI was one of them. Cryptonews put DAFI's loss at about $200,000 worth of DAFI, while ChainCatcher reported 200,000 DAFI tokens sold; the two figures are far apart and neither cites a transaction. DAFI fell 22.8% in the 24 hours after the announcement, per Cryptonews.
The flaw was in ChainSwap's bridge contract, not in DAFI's token. DAFI said its token contracts and super staking funds were not affected. It asked users to withdraw liquidity from Uniswap and its LP program until the issue was resolved, and announced it would buy DAFI back on the open market, over six months according to ChainCatcher.
How it happened
- ChainSwap's bridge contract for each supported token had a receive path that released or minted bridged tokens to a
toaddress once a cross-chain transfer was authorized by signers. - According to Christoph Michel's analysis, the
_receiveflow accepted a single signature and did not check that the signer was a real bridge authority. Each signer's daily limit was tracked by_decreaseAuthQuota, and an address the contract had never seen started from the default quota. - The attacker called the receive function repeatedly, signing each call with a new address, paying the 0.005 ETH fee charged in
_chargeFee, and setting the recipient to their own wallet (0xEda5066780dE29D00dfb54581A707ef6F52D8113). - This minted large amounts of bridged tokens for more than 20 projects, including DAFI, which the attacker sold on DEXes, crashing their prices. Rekt estimated the total ChainSwap loss at about $4.4 million; ChainCatcher put the attacker's profit at about $2.3 million.
Protocol details
Evidence
- report Report cryptonews.net
- report Report altcoinbuzz.io
- report ChainSwap - REKT rekt.news
- transaction Etherscan: ChainSwap attacker address transactions etherscan.io
- analysis Dafi Protocol Suffers Exploit, Loses $200,000 (Cryptonews) cryptonews.net
- analysis Over 20 projects stolen from the Chainswap cross-chain bridge (ChainCatcher) chaincatcher.com
- analysis Explained: The ChainSwap Hack (July 2021) (Halborn) halborn.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
