What happened
On October 24, 2022, a flash-loan attack exploited about $220,000 from the Market XYZ lending market in QuickSwap Lend. QuickSwap said Market XYZ was the only affected market, its core contracts and user funds were unaffected, and it closed its lending markets after the incident.
How it happened
- The attacker used flash-loaned capital to add liquidity to the Curve pool whose LP token Market XYZ accepted as collateral.
- During
remove_liquidity, the attacker's callback re-entered Curve'sget_virtual_price()while pool accounting was unsettled. - Market XYZ used that temporarily inflated LP value to extend a loan against overvalued collateral.
- The attacker withdrew the borrowed MAI, repaid the flash loan, and retained the reported proceeds; QuickSwap then closed QuickSwap Lend.
Protocol details
Classification
Exchange (DEX) / Oracle Manipulation
Protocol Type
Exploit/Flash Loan Attack
Implementation language
Solidity
Protocol links
Website
@QuickswapDEX
Evidence
- report @BeosinAlert incident report twitter.com
- report @QuickswapDEX incident report twitter.com
- analysis Polygon's QuickSwap Hit With $220,000 Flash Loan Attack decrypt.co
- analysis DeFiLlama defillama.com
- analysis Everything You Need to Know About How to Use QuickSwap Lend blog.quickswap.exchange
- analysis Decoding $220K Read-only Reentrancy Exploit quillaudits.medium.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
