Incident Overview
Gamma Strategies, a decentralized asset management protocol, suffered a price manipulation attack, resulting in a loss of 6,412,750 $USD worth 2,825 $ETH.
On Jan 4, 2024, Gamma Strategies was exploited through a series of attack transactions using flash loans from Uniswap and Balancer to manipulate pool prices. The primary issue was the deposit proxy settings related to the price change threshold (2), which was set too high, allowing for a -50% to +100% price change on certain LST and stablecoin vaults. This enabled the attacker to manipulate the price up to the threshold and generate an unusually high number of LP tokens.
The attacker revealed a flaw in the deposit proxy configurations, specifically targeting stable and LST vaults. Although the vaults are equipped with four primary deposit protection measures against flash loans, the exploit highlighted a vulnerability in one of these safeguards. The hackers bridged stolen funds from the Arbitrum chain to the Ethereum network using the Stargate bridge and deposited part of the stolen funds into TornadoCash.
Attacker Address:
https://arbiscan.io/address/0x53515361…31909c
Funds Holder as of Jan 13, 2024:
https://etherscan.io/address/0xeA723Ce3…6cE224
Malicious Transactions:
https://arbiscan.io/tx/0x025cf285…79be75
https://arbiscan.io/tx/0x1b991177…a75354
Malicious Contract Address:
https://arbiscan.io/address/0x4B57ADC0…b78A69
TornadoCash Deposit Transaction:
https://etherscan.io/tx/0x7b2d9570…0b80a9
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Gamma Strategies, these are the critical security checks that could have prevented this incident (January 2024).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
-
02
Web Archive https://archive.is/Y7eTJ
Learn to Prevent the Next Gamma Strategies
The Gamma Strategies hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.