What happened
On December 10, 2022, the TiFi lending contract on BNB Chain was drained of its TIFI token reserve through a flash-loan price manipulation. PeckShield reported that 529,570,181,341 TIFI were taken for a profit of about $25,000; DeFiHackLabs lists the loss as 87 WBNB. PeckShield also noted that the original attacker's transaction was front-run, and it links the front-running transaction: 0x1c5272ce35338c57c6b9ea710a09766a17bbf14b61438940c3072ed49bfec402.
How it happened
- The attacker took a flash swap of WBNB and BUSD from a PancakeSwap pair.
- It deposited the BUSD into the TiFi lending contract as collateral.
- It swapped its WBNB for BUSD through TiFi's router, shifting the reserves of the WBNB-BUSD pool that the lending contract reads with
getReserveswhen valuing a borrow. - With the price distorted, it called
borrowand took the lending contract's entire TIFI balance. - It sold the TIFI for WBNB on PancakeSwap, repaid the flash swap and kept the rest.
Protocol details
Classification
Oracle Manipulation
Protocol Type
Token
Implementation language
Solidity
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
