SynLev Hack

The removeLiquidity() function makes a call of the external function getSharePrice() in vaultHelper contract:

https://etherscan.io/address/0xe0d6b684…fa00f2#code

vaultHelper is a proxy contract with EOA owner - 0xa2e316cb…5c83c4

The owner could set any address as price aggregator in vaultHelper calling proposeVaultPriceAggregator()

A new aggregator (unverified contract) was provided in the transaction:

https://etherscan.io/tx/0xc888619c…7107a6

This hidden aggregator set the share price to 0.

After this, the contract deployer easily withdrew all vault balance with zero share price which can be found in the event log: https://etherscan.io/tx/0x216db3ca…1f0951#eventlog

The contract deployer added liquidity into the contracts multiple times:

https://bloxy.info/txs/references_address/0xa2e316cb…5c83c4?argument=account&signature_id=1315743

https://bloxy.info/txs/calls_from/0xa2e316cb…5c83c4?signature_id=1315634&smart_contract_address_bin=0xff40827e…1440e3

The contract deployer invoked the removeLiquidity() function into the vault contract to withdraw 541.27 and 20.41 ETH onto his wallet at:

https://etherscan.io/tx/0x216db3ca…1f0951

https://etherscan.io/tx/0x5131d999…97fce4

The contract deployer invoked the ethremove() function into the synSales contract to withdraw 152.09 ETH onto his wallet at:

https://etherscan.io/tx/0xec4ba66c…e1602d

The contract deployer invoked the removeLiquidity() function into the other vault contract to withdraw 104.41 ETH onto his wallet at:

https://etherscan.io/tx/0x6afe1ec9…509d8d

The contract deployer invoked the removeLiquidity() function into the other vault contract to withdraw 10.59 ETH onto his wallet at:

https://etherscan.io/tx/0x5c7644f7…764e51

The contract deployer invoked the removeLiquidity() function into the other vault contract to withdraw 24.26 ETH onto his wallet at:

https://etherscan.io/tx/0xe4c8cc92…800397