What happened
Nimbus Platform (Nimbus DAO) on BNB Chain lost about 278 BNB (around $76,000) on December 14, 2022, when an attacker used a flash loan to inflate the rewards paid by its GNIMB staking contracts.
The staking contracts paid rewards in GNIMB, and getReward() sized each payout using the NIMB price read directly from the NIMB / NBU_WBNB pool. With about 75,477 borrowed BNB, the attacker bought most of the NIMB out of that pool. SolidityScan reports that this pushed the NIMB-to-GNIMB ratio used for rewards to about 2,919.7:1. The attacker then claimed rewards on its own staking positions at the inflated rate, sold the GNIMB and NIMB back to BNB, and repaid the loan inside the same transaction.
**Block data**
- Attacker:
0x86aa1c46f2ae35ba1b228dc69fb726813d95b597 - Exploit transaction:
0x42f56d3e86fb47e1edffa59222b33b73e7407d4b5bb05e23b83cb1771790f6c1 - Related earlier transaction listed by DeFiHackLabs:
0x7d2d8d2cda2d81529e0e0af90c4bfb39b6e74fa363c60b031d719dd9d153b012 - Staking contract:
0x3aa2b9de4ce397d93e11699c3f07b769b210bbd5 - Locked staking contract:
0x706065716569f20971f9cf8c66d092824c284584
How it happened
- The attacker held GNIMB staking positions in the fixed-APY staking contracts, so there were rewards to claim.
- It flash-borrowed WBNB (SolidityScan puts the total at about 75,477 BNB), converted it to Nimbus's wrapped BNB,
NBU_WBNB, and swapped it into the NIMB / NBU_WBNB pool, buying most of the pool's NIMB and sharply raising the NIMB price. - With the pool skewed, it called
getReward()on its positions. The reward formula priced NIMB from that pool, so the GNIMB payout was far larger than normal. - It swapped the NIMB and the reward GNIMB back to BNB, repaid the flash loans, and kept about 278 BNB.
Protocol details
Evidence
- report @BeosinAlert incident report twitter.com
- transaction bscscan.com transaction 0x42f5…f6c1 bscscan.com
- transaction phalcon.blocksec.com transaction 0x42f5…f6c1 phalcon.blocksec.com
- address bscscan.com address 0x86aa…b597 bscscan.com
- code DeFiHackLabs Nmbplatform_exp.sol PoC github.com
- code DeFiHackLabs 2022 index: 20221214 - Nmbplatform - FlashLoan price manipulation github.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Nimbus DAO hack Analysis - Oracle Price Manipulation Bug blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
