Sanshu Inu Hack

The attacker's address:

Address 0x0333…4fec

The affected Memstake contract:

Address 0x35c6…7810

The attacker:

• Created two attack contracts, the first one deposited 2,049B KEANU:

Address 0x67a5…9dc3

the second one is the attack contract:

Address 0xe30d…d59f

• Borrowed a large number of KEANU tokens using the flash loan from UniswapV2, and then deposited the tokens into/withdraws from the Memestake using the second smart contract. Since the KEANU has the deflation mechanism, which burns 2% tokens for each transaction, the real number of tokens deposited into the Memestake is smaller than the value (user.amount) maintained by the Memestake contract. The attacker repeated this process and made the number of KEANU tokens inside the Memestake decrease to a small one (1e-07):

Tx 0x00ed…5808

• Invoked the Memestake.updatePool() to update the accMfundPerShare. This value relies on the number of KEANU tokens (which was manipulated in the second step.) Then the attacker obtained a large number of Mfund(~61M):

Tx 0xa945…de41

• Swapped the MFund and KEANU to WETH and deposited stolen funds into Tornado Cash mixer:

Source

The attacker gained 156.51 ETH as profits.