What happened
Quick Summary
Price of the HEALTH token in a Uniswap pool was manipulated allowing the attacker to take a 33 BNB profit.
Details of the Exploit
The exploit was possible due to a bug in the internal _tranfer() function of the token contract that was causing decrease of HEALTH in the pool.
The attack was performed in three transactions. Each transaction involved the following steps:
- Taking a flash loan of 40 WBNB;
- Exchanging the borrowed amount to HEALTH;
- Calling 999 token transfers with 0 value. Due to the bug in _transfer(), the number of HEALTH in the pool decreased each time, hence the token price was increasing.
- Exchanging the inflated HEALTH token to WBNB with profit.
- Paying back the flashloan
Block Data Reference
The attacker contract:
The attack transactions:
Protocol details
Classification
Token
Protocol Type
Exploit/Other
Affected asset / contract
HEALTH
Evidence
- report Report blog.solidityscan.com
- report @BlockSecTeam incident report twitter.com
- analysis Web Archive archive.ph
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
