Incident Overview
The attacker's address:
https://bscscan.com/address/0x0f3c0c62…298b35
The malicious token contract:
https://bscscan.com/address/0xb7a740d6…22dfb7
The attacker deployed a malicious token contract, which is also used as the attack contract, and created a PancakeSwap pair for the token and BUSD.
The attacker made a flash loan from the Rabbit Bank contract and called the execute function on StrategyLiquidate:
https://bscscan.com/address/0x5085c498…033369
The execute method decodes input data as the LP token address, allowing the attacker to execute code from the malicious token contract.
The malicious token contract called FlurryRebaseUpkeep.performUpkeep() which rebases all vaults and updates multipliers for Rho Tokens. The update is based on all strategies' balances.
The update was triggered in the process of a flash loan and the tokens borrowed from the Bank contract were not returned yet, the low balance led to a low multiplier.
The attacker returned the flash loan and finished the preparation transaction.
In the next transaction, the attacker deposited tokens with the low multiplier, updated the multiplier to a higher (normal) value, and withdrew the tokens with the high multiplier.
Because the multiplier is one of the factors deciding the RhoToken balance, the attacker's RhoToken balance was increased in the transaction so they were able to withdraw more tokens than they deserve from the Vault.
The attacker repeated this process multiple times.
Stolen funds were transferred to this address and then redistributed between several external addresses:
https://bscscan.com/address/0xb7a740d6…22dfb7#tokentxns
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Flurry Finance, these are the critical security checks that could have prevented this incident (February 2022).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Flurry Finance
The Flurry Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.