What happened
On March 20, 2022, an attacker drained the LP tokens staked in Umbrella Network's Polar Stream reward pools on Ethereum and BNB Chain, taking about $700,000. The bug was an integer underflow in the staking contract's withdraw() function, which let the attacker withdraw far more than they had deposited.
withdraw() subtracted the requested amount from the caller's balance without first checking that the balance was large enough, and the arithmetic was not checked for underflow. A withdrawal larger than the balance did not revert. The balance wrapped around to a huge number, and the contract sent out the requested LP tokens. The attacker took all the UMB-ETH Uniswap and UMB-BNB PancakeSwap LP tokens in the pools, removed that liquidity, and sold more than 2.2 million UMB on the open market.
Umbrella said it would buy back 2.2 million UMB to offset the dump. Its insurance partner Uno Re accepted a claim and paid affected users up to $10,000 each, covering 91% of affected wallet addresses; this was Uno Re's first claim payout.
Attacker: 0x1751e3e1aaf1a3e7b973c889b7531f43fc59f7d0
Attack contract: 0x89767960b76b009416bc7ff4a4b79051eed0a9ee
How it happened
- The Polar Stream
StakingRewardscontract held users' staked UMB-ETH and UMB-BNB LP tokens. - The attacker, through a contract, called
withdraw()with an amount far larger than their staked balance. withdraw()computed_balances[user] - amountwithout a balance check or safe math, so the subtraction wrapped around instead of reverting, and the contract sent out the LP tokens.- The attacker repeated this on Ethereum and BNB Chain and emptied both pools.
- They removed the stolen liquidity from the Uniswap and PancakeSwap pools and sold more than 2.2 million UMB, for about $700,000 in losses.
Protocol details
Evidence
- report Post-mortem medium.com
- report @UmbNetwork incident report twitter.com
- report @peckshield incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs Umbrella_exp.sol proof of concept (2022-03) raw.githubusercontent.com
- analysis Uno Re Covers Umbrella Network Reward Pool Hack Victims' Losses newsfilecorp.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
