DualPools Hack

Reported loss $41K
BNB Chain
Flash Loan Attack

What happened

DualPools, a lending, borrowing and swap protocol on BNB Chain built from a modified Venus Protocol, was exploited on 15 February 2024 for about $41,000. The attacker went after a new dLINK market that had no liquidity. By minting a tiny amount of dLINK and then sending LINK straight to the market, they pushed its exchange rate up enormously. Two base units of dLINK were then enough collateral to borrow WBNB, BTCB, ETH, ADA and BUSD from the other markets. A rounding-down error in redeemUnderlying let them take back almost all of the LINK they had put in while burning only one of the two dLINK units. Lunaray put the proceeds at 50 BNB, 0.17 BTCB, 3.99 ETH, 6,378 ADA and about 904-911 BUSD.

Attacker: 0x4645863205b47a0A3344684489e8c446a437D66C (0x7F27C9ed8CEb95Ae69E8361221fe17100f826616 is also listed as an additional attacker address)

Exploit transaction: 0x90f374ca33fbd5aaa0d01f5fcf5dee4c7af49a98dc56b47459d8b7ad52ef1e93

Attack contract: 0x38721b0d67DFdba1411BB277d95AF3D53FA7200E

According to the existing record, the proceeds were swapped to BNB, sent to another address and deposited into Tornado Cash about a week later (0xcedff18c5478037f057072a9dc2eb808398c47e8c2023f4848430a73e5b741c2, 0x7de2a931257c5a2aef16a410402729fb238e7c35f6f40e6304d62c95a2aa24ec).

How it happened

  1. The attacker flash-borrowed BNB and BUSD from DODO private pools and PancakeSwap V3, supplied them to Venus as collateral, and borrowed 11,500 LINK.
  2. They minted 2 base units of dLINK in the new, empty DualPools LINK market, then transferred about 11,500 LINK directly into it. With totalSupply at 2 and no borrows or reserves, exchangeRate = (totalCash + totalBorrows - totalReserves) / totalSupply jumped to about 5.75e21.
  3. Now valued at the inflated rate, the 2 dLINK units served as collateral to borrow 50 BNB, 0.17 BTCB, 3.99 ETH, 6,378 ADA and 911 BUSD from other DualPools markets.
  4. They called redeemUnderlying for almost all the LINK in the market. The number of dLINK to burn worked out to about 1.999999, which integer division truncated to 1, so they got the LINK back while burning only one unit.
  5. They repaid Venus and the flash loans and kept the borrowed assets, about $41,000.

Protocol details

Classification Borrowing and Lending / Token & Share Accounting
Protocol Type Exploit/Flash Loan Attack
Affected asset / contract dLINK
Implementation language Solidity
Protocol links @dualpools

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Same attack technique

Browse all hacks →
Ethereum Thetanuts Finance $105K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes