iVest Hack

What happened

On August 12, 2024, an attacker used iVest's custom donation transfer behavior to distort the WBNB/iVest AMM pool's reserve ratio after flash-borrowing WBNB. Verichains estimated the loss at about $172,000; the $190,000 figure shown here comes from a different estimate.

How it happened

1. The attacker flash-borrowed WBNB and swapped it for iVest.
2. They transferred iVest to the WBNB/iVest pair and invoked skim(address(0)), causing the token's donation behavior to deduct additional iVest from the pool.
3. They called sync() to record the reduced iVest balance as the pool reserve, distorting the reserve ratio.
4. The attacker swapped remaining iVest back to WBNB at the manipulated price.

Protocol details

Classification Protocol Logic

Protocol Type Token

Implementation language Solidity

Evidence

• analysis DeFiLlama defillama.com
• analysis iVest Token Vulnerability: How an Attacker Manipulated Prices Using the Donation Feature blog.verichains.io
• analysis DeltaPrime, iVest, and Spectra Finance Lose $1.25M to Storage Collisions, Burn Abuse, and Call Injection olympix.security