ERC20 Token Bank Hack

What happened

On May 31, 2023, ERC20TokenBank lost about 111,500 USDC through a price-manipulation attack on its trusted ExchangeBetweenPools swap path. The vulnerable function could sell the bank's full USDC balance into Curve's yPool with min_dy set to zero, accepting an attacker-manipulated price.

How it happened

1. The attacker flash-borrowed 120,000 USDC from a Uniswap V3 pool.
2. They used the borrowed USDC to skew Curve's yPool toward excess USDC and scarce USDT.
3. The attacker called the public doExchange() path, causing ExchangeBetweenPools to pull ERC20TokenBank's 119,023.52 USDC and swap it in the distorted pool with min_dy = 0.
4. The bank received only 47.39 USDT for that sale.
5. The attacker reversed their position, repaid the flash loan, and retained 111,500.39 USDC.

Protocol details

Classification Other

Protocol Type Exploit/Flash Loan Attack

Evidence

• report @DeDotFiSecurity incident report twitter.com
• analysis ERC20TokenBank / ExchangeBetweenPools Exploit — Zero-Slippage Curve Swap Sandwich crypto.training

Understand the attack patterns

Compare incidents →

Flash Loan Attacks