What happened
On June 7, 2022, an attacker exploited a flawed Equalizer vault calculation across multiple networks. Equalizer's incident report illustrates the Polygon sequence: a flash loan and Equalizer borrow reduced a vault's USDC balance, then a liquidity add and repayment restored it before the attacker withdrew 100,000 USDC for roughly 50,000 LP tokens. The report says the attacker kept about 50,000 USDC from that vault and repeated the method against other vaults and tokens.
How it happened
- The attacker flash-loaned roughly 50,000 USDC, then borrowed roughly 50,000 USDC from an Equalizer vault, reducing that vault's USDC balance.
- The attacker added roughly 50,000 USDC as liquidity, received LP tokens, and repaid the flash loan to restore the vault balance.
- The attacker removed liquidity. Equalizer says the flawed
getRatioForOneEToken()calculation then allowed a 100,000-USDC withdrawal for approximately 50,000 LP tokens. - After repaying the Uniswap flash loan, the attacker retained approximately 50,000 USDC from the illustrated vault and repeated the sequence on other vaults and tokens.
Protocol details
Classification
Protocol Logic
Protocol Type
DEX
Affected asset / contract
EQZ
Implementation language
Solidity
Protocol links
Website
@EqualizerFlash
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
