What happened
On August 1, 2023, an attacker took about 23.5 ETH from Neutra Finance on Arbitrum by manipulating the price used in its LP-token convert function. Neutra's convert contract swapped one Camelot LP token for another. The two pools' LP tokens were both named CMLT-LP (CMLT-LP-65eb for WETH/NEU and CMLT-LP-2ea3). BlockSec Phalcon traced the loss to the convert function relying on a spot price that could be moved within a single transaction.
The attack was funded with a 1,000 WETH Balancer flash loan and repaid in the same transaction. Attacker: 0x39B842bB7287AfC516Db176b76C5cBBd8Caa1E84. Attack tx: 0x6301d4c9f7ac1c96a65e83be6ea2fff5000f0b1939ad24955e40890bd9fe6122.
How it happened
- The attacker flash-loaned 1,000 WETH from Balancer.
- They swapped 0.15 WETH for NEU and added liquidity to the Camelot WETH/NEU pool, receiving
CMLT-LP-65ebtokens. - They swapped 849 WETH into the same pool for NEU, pushing its spot price far out of line.
- They called
convert()on Neutra's convert contract with theirCMLT-LP-65eb, which priced the conversion from the manipulated spot reserves and paid out an outsized amount ofCMLT-LP-2ea3from the contract's balance. - They swapped their NEU back to WETH, burned the
CMLT-LP-2ea3for its underlying tokens, sold those for WETH, and repaid the flash loan, keeping about 23.5 ETH.
Protocol details
Security review history
- SolidProof View report
Evidence
- report BlockSec Phalcon alert on Neutra Finance (via fxtwitter mirror) x.com
- transaction Arbiscan transaction 0x6301d4c9...fe6122 arbiscan.io
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs NeutraFinance_exp.sol PoC raw.githubusercontent.com
- analysis Phalcon: Neutra Finance suffers price manipulation attack (BlockBeats) en.theblockbeats.news
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
