LV Finance Hack

The core staking smart contracts were backdoored with the addReward() function. The following contracts accepted deposits from users in different tokens:

https://etherscan.io/address/0x80c09d3c…59a494#code

https://etherscan.io/address/0x9e1d0964…75deb7#code

https://etherscan.io/address/0x7b63771f…c39f80#code

https://etherscan.io/address/0xa2a430ce…d6f27d#code

https://etherscan.io/address/0xb7b3ab63…dd2f3e#code

https://etherscan.io/address/0x828995b4…5f7a27#code

https://etherscan.io/address/0x5a529c3a…72bc6c#code

https://etherscan.io/address/0xd76e4470…02f7f1#code

https://etherscan.io/address/0xbca5fc48…89ca06#code

https://etherscan.io/address/0xc3dc2d24…7b903f#code

https://etherscan.io/address/0xe52dfd3d…2a3e14#code

https://etherscan.io/address/0x478e26cb…d28c02#code

In the example below, the external address refers to each smart contract by invoking addReward() function and withdrawing user's deposits:

https://etherscan.io/tx/0xa5b92bb9…f03325

In total, 201.5K USDC, 79.6K USDT, 8.1 LEND, 2.7K SUSHI, 816 UNI, 1K LINK, 1.3 SNX, 261 YFV, 0.02 YFI, 82.1 PYLON and 0.76 YFII were stolen and exchanged on ETH.