QuickSwap Hack

QuickSwap exchange was exploited through a flash loan attack. The hacker managed to transfer 190,000 $USD using TornadoCash.

QuickSwap is a DEX running on the Polygon chain. The hacker used the deployed smart contract with unverified source code to perform a flash loan attack. AAVE and Balancer platforms were used to loan 43,000,000 $USD worth of $MATIC and to manipulate an assets price on the pool.

QuickSwap tweeted, mentioning that only the MarketXYZ lending platform's contracts were affected, cause of the Curve Oracle. The hacker made a profit of 190,000 $USD after paying the flash loans and bridged the funds to the Ethereum chain and consequently to the TornadoCash.

Attacker address:

https://polygonscan.com/address/0x4206d623…d181a0

Malicious contract:

https://polygonscan.com/address/0xeb4c67e5…81e4eb

Malicious transaction:

https://polygonscan.com/tx/0xb8efe839…387558

Bridge transaction:

https://polygonscan.com/tx/0x771018d8…c8dc1b