ElasticSwap Hack

Reported loss $854K

Dec 13, 2022 Avalanche Ethereum

Price Oracle Attack

What happened

Quick Summary

On the 13th of December, 2022, Elastic Swap was hacked on the Avalanche and Ethereum Chain using a calculation issue. The malicious actor stole worth around 850k USD.

Details of the Exploit

The attack was possible in the reason of using two different logic of calculation in the exploited smart contracts. Functions addLiquidity and removeLiquidity have different logic of accounting. While the first one uses constant variables the second one is using dynamic pool balance calculation.

This led to the possibility of price manipulation after the pool unbalancing.

Block Data Reference

Avalanche:

Attacker address:

Exploit tx:

Ethereum:

Exploit tx:

Tx 0xc2d8…cbda