Sanshu Inu Hack

The attacker's address:

https://etherscan.io/address/0x0333e323…9f4fec

The affected Memstake contract:

https://etherscan.io/address/0x35c674c2…1c7810#code

The attacker:

- created two attack contracts, the first one deposited 2,049B KEANU:

https://etherscan.io/address/0x67a54b34…0d9dc3

the second one is the attack contract:

https://etherscan.io/address/0xe30dc9b3…3ad59f

- borrowed a large number of KEANU tokens using the flash loan from UniswapV2, and then deposited the tokens into/withdraws from the Memestake using the second smart contract. Since the KEANU has the deflation mechanism, which burns 2% tokens for each transaction, the real number of tokens deposited into the Memestake is smaller than the value (user.amount) maintained by the Memestake contract. The attacker repeated this process and made the number of KEANU tokens inside the Memestake decrease to a small one (1e-07):

https://etherscan.io/tx/0x00edd680…285808

- invoked the Memestake.updatePool() to update the accMfundPerShare. This value relies on the number of KEANU tokens (which was manipulated in the second step.) Then the attacker obtained a large number of Mfund(~61M):

https://etherscan.io/tx/0xa945b185…8dde41

- swapped the MFund and KEANU to WETH and deposited stolen funds into Tornado Cash mixer:

https://bloxy.info/txs/calls_from/0x0333e323…9f4fec?signature_id=994162&smart_contract_address_bin=0x722122df…5b6967

The attacker gained 156.51 ETH as profits.