Incident Overview
On June 7-th Equalizer Finance suffered from a flash loan attack. The EqualizerFinance has FlashLoanProvider contract that providers flash loans, and the Vault contract used for borrowing funds by calling flashLoan() function.
Flash loan attack explanation:
The attacker first borrows 165.3 WBNB from PancakeSwap using flash loan.
Event 15: https://bscscan.com/tx/0xdc4ea764…5035f0#eventlog
The FlashLoanProvider provider first transfers the WBNB liquidity to the attacker in the WBNB storage contract, which is then followed by the flash loan callback.
The attacker then provides liquidity to the WBNB repository in a second instant callback.
The attacker then returns the secondary flash loan and removes the liquidity from the WBNB vault.
By targeting the storage contracts in each chain, the attacker was able to withdraw liquidity from Equalizer Finance.
Attack transactions:
ETH - https://etherscan.io/tx/0x9b17f61d…c17f41
BSC - https://bscscan.com/tx/0xdc4ea764…5035f0
Attacker address:
BSC - https://bscscan.com/address/0x00000035…da526e
ETH - https://etherscan.io/address/0x00000035…da526e
Attacker contract address:
ETH - https://etherscan.io/address/0xf667e04a…29a67f
BSC - https://bscscan.com/address/0xf667e04a…29a67f
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Equalizer Finance, these are the critical security checks that could have prevented this incident (June 2022).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Equalizer Finance
The Equalizer Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.