Visor Finance Hack

The attacker:

https://etherscan.io/address/0x8efab89b…7774b2

The transaction behind the attack:

https://etherscan.io/tx/0x69272d8c…c1ff3f

Exploited contract:

https://etherscan.io/address/0xc9f27a50…da14ef#code

The problem:

Deposit function calls delegatedTransferERC20 function on any contract from parameter "from" without any restrictions, this function call opens ability for reenter target contract. After calling delegatedTransferERC20 function deposit was called a second time. This lead to minting double share amount. In addition, there is no check for the "from" parameter, so the called contract can do nothing, and the function can be called with any value for visrDeposit parameter.

Minted share tokens were withdrawn and exchanged for VISAR tokens. Then the attacker sold them in liquidity pair on Uniswap and deposited them into Tornado Cash mixer:

https://etherscan.io/address/0x8efab89b…7774b2#tokentxns

https://bloxy.info/txs/calls_from/0x8efab89b…7774b2?signature_id=994162&smart_contract_address_bin=0x722122df…5b6967