ElasticSwap Hack

TOTAL LOST $854K

Low Dec 13, 2022 Oracle Manipulation & Price Manipulation avalanche ethereum

What happened

Quick Summary

On the 13th of December, 2022, Elastic Swap was hacked on the Avalanche and Ethereum Chain using a calculation issue. The malicious actor stole worth around 850k USD.

Details of the Exploit

The attack was possible in the reason of using two different logic of calculation in the exploited smart contracts. Functions addLiquidity and removeLiquidity have different logic of accounting. While the first one uses constant variables the second one is using dynamic pool balance calculation.

This led to the possibility of price manipulation after the pool unbalancing.

Block Data Reference

Avalanche:

Attacker address:

https://snowtrace.io/address/0x3bdf01ed…5743cd

https://snowtrace.io/address/0x25fde76a…103c56

https://snowtrace.io/address/0xdd8429b8…d60cbd

Exploit tx:

https://snowtrace.io/tx/0x782b2410…cd9b18

Ethereum:

Exploit tx:

https://etherscan.io/tx/0xc2d86035…f5cbda

Front-run tx:

https://t.co/YGMaRQj6Lk

Case & protocol details

Classification Ecosystem / Exchange (DEX) / Oracle Manipulation

Protocol Type DEX

Affected asset / contract TIC

Official Website elasticswap.org/

Protocol Twitter/X @ElasticSwap

Security review history

Code4rena Report

Evidence & learning

Attack pattern

Compare incidents →

Oracle Manipulation & Price Manipulation

Proof of concept

1 available

Code ElasticSwap Business Logic Flaw

Sources and on-chain records

report Post-Mortem quillaudits.medium.com
report Report twitter.com
analysis Web Archive archive.vn
analysis Website reference twitter.com
analysis Blog reference blog.solidityscan.com

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes