Formation.Fi Hack

The attacker:

https://etherscan.io/address/0x89640eb6…0e3ae1

The transaction behind the attack:

https://etherscan.io/tx/0x5c9ac39c…afb6ab

The attack contract:

https://etherscan.io/address/0xb5aef637…b1711e

Affected contracts:

https://bscscan.com/address/0xe2ee850d…3f0012

https://etherscan.io/address/0x62931dec…08334b

The farming contract has been using the balance of the pool for price discovery of the FORM token and LP token in order to calculate the USD (stable coin) value of the position and pay rewards accordingly.

The Flash Swap mechanism allows to alter the price of the FORM token — the exploit contract used that in order to excessively increase the value of the reward calculated at the withdrawal transaction.

The attacker:

- staked LP tokens.

- pulled available funds from the pool, unstaked LP token, and sent back funds to the pool.

Further exploitation was prevented by devs by setting the multiplier to 0, which makes the contract send no FORMs for any new staked LP tokens:

https://etherscan.io/tx/0x9aad3091…63efc8