What happened
On November 10, 2022, DFX Finance's Ethereum swapping contracts were exploited through their flashloan and deposit flow. The attacker borrowed pool tokens, deposited them during the flashloan callback so the pool's balance check passed, received LP tokens, and then withdrew the underlying assets. Independent analyses estimate the profit or loss at approximately $4 million to $5 million.
How it happened
- The attacker used DFX's pair-contract flashloan to borrow pool tokens.
- During the flashloan callback, the attacker deposited the borrowed tokens, with additional tokens, back into the pool.
- That deposit increased the pool balances and bypassed its repayment check while minting LP tokens to the attacker.
- The attacker then burned the LP tokens through
withdraw()and received the pool assets.
Protocol details
Security review history
- Trail of Bits View report
Funds Recovery
Recovered
$205K
Net Loss
$7,438,861
Post-Incident Timeline
-
2022-11-19
The DFX Finance started a multi-phase recovering plan. The project already provided 2,000,000 $DFX tokens which are worth 204,800 $USD at the moment to help recover affected Liquidity Pools. The funds to be recovered were fully calculated and published.
Evidence
- report Report theblock.co
- report @DFXFinance incident report twitter.com
- report @spreekaway incident report twitter.com
- report @DFXFinance incident report twitter.com
- report Report docs.google.com
- report @peckshield incident report twitter.com
- report V2 Vulnerability Post Mortem medium.com
- analysis DeFiLlama defillama.com
- analysis DFX Finance US$4 Million Smart Contract Attack Analysis numencyber.com
- analysis DFX Finance certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
