Flurry Finance Hack

The attacker's address:

https://bscscan.com/address/0x0f3c0c62…298b35

The malicious token contract:

https://bscscan.com/address/0xb7a740d6…22dfb7

The attacker deployed a malicious token contract, which is also used as the attack contract, and created a PancakeSwap pair for the token and BUSD.

The attacker made a flash loan from the Rabbit Bank contract and called the execute function on StrategyLiquidate:

https://bscscan.com/address/0x5085c498…033369

The execute method decodes input data as the LP token address, allowing the attacker to execute code from the malicious token contract.

The malicious token contract called FlurryRebaseUpkeep.performUpkeep() which rebases all vaults and updates multipliers for Rho Tokens. The update is based on all strategies' balances.

The update was triggered in the process of a flash loan and the tokens borrowed from the Bank contract were not returned yet, the low balance led to a low multiplier.

The attacker returned the flash loan and finished the preparation transaction.

In the next transaction, the attacker deposited tokens with the low multiplier, updated the multiplier to a higher (normal) value, and withdrew the tokens with the high multiplier.

Because the multiplier is one of the factors deciding the RhoToken balance, the attacker's RhoToken balance was increased in the transaction so they were able to withdraw more tokens than they deserve from the Vault.

The attacker repeated this process multiple times.

Stolen funds were transferred to this address and then redistributed between several external addresses:

https://bscscan.com/address/0xb7a740d6…22dfb7#tokentxns