What happened
The attacker:
The transaction behind the attack:
The attack contract:
Affected contracts:
The farming contract has been using the balance of the pool for price discovery of the FORM token and LP token in order to calculate the USD (stable coin) value of the position and pay rewards accordingly.
The Flash Swap mechanism allows to alter the price of the FORM token — the exploit contract used that in order to excessively increase the value of the reward calculated at the withdrawal transaction.
The attacker:
- Staked LP tokens.
- Pulled available funds from the pool, unstaked LP token, and sent back funds to the pool.
Further exploitation was prevented by devs by setting the multiplier to 0, which makes the contract send no FORMs for any new staked LP tokens:
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
