Kaoya Swap Hack

On August 24th, 2022, KaoyaSwap, a decentralized transaction protocol built on the Binance Smart Chain, was attacked due to a bug in the swapExactTokensForETHSupportingFeeOnTransferTokens function. The vulnerability allowed the attacker to steal approximately $118,000 worth of 37,294 BUSD and 271.2 wBNB.

The bug was found in the swapExactTokensForETHSupportingFeeOnTransferTokens function, which was used to swap Fee-On-Transfer-Tokens. These tokens charge a fee for every transfer() or transferFrom(), causing the receiver to get less than the sent amount. The function miscalculated the amount to be transferred to the user when the last pair appeared multiple times in the swap path, allowing the attacker to steal funds.

The Attack Process:

The attacker designed a swap path that included two self-constructed tokens, resulting in the tokenA and wBNB pair being included twice in the swap path. The attacker borrowed a flash loan of 1800 wBNB and added liquidity to newly constructed token pairs. After the swap and removing liquidity, the attacker profited around 271 wBNB and 37,295 BUSD.

After the Exploit:

KaoyaSwap has yet to release an official statement. BlockSec identified several addresses that profited from the attack.

Exploit tx:

https://bscscan.com/tx/0xc8db3b62…208d74

Involved addresses:

https://etherscan.io/address/0x8df3dd42…749ca1

https://etherscan.io/address/0x236b6150…c891e5

https://etherscan.io/address/0xb77e7ee8…208589

https://etherscan.io/address/0xe946bc15…36df09

https://etherscan.io/address/0x50fc7d75…0b4d28