Incident Overview
Exploitation of WarpFinance via flash loans resulted in a loss of approximately $7.8 million.
The attacker initiated the exploit by taking four different flash loans of 2.9M DAI + 344.8K WETH from dYdX and UniswapV2. They then deposited the dYdX flash loan into the UniswapV2 pair (WETH-DAI), minting 94.349K LP tokens in return. These tokens were transferred to WarpVaultLP as collateral.
The attacker then swapped 341K WETH for 47.6M DAI via UniswapV2, causing DAI to become very expensive and doubling the LP token price. With the inflated LP token price and collateral value, the attacker was able to borrow 3.86M DAI and 3.9M USDC from WarpFinance, totaling about $7.8 million. The attacker then returned the flash loans to dYdX and UniswapV2.
Smart contract used in the attack:
https://etherscan.io/address/0xdf8bee86…3dbacb
Transactions involved in the attack:
https://ethtx.info/mainnet/0x8bb8dc5c…595090
https://etherscan.io/tx/0x8bb8dc5c…595090
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Warp Finance, these are the critical security checks that could have prevented this incident (December 2020).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$5.8M
Net Loss
1996799
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
-
02
Web Archive https://rekt.news/warp-finance-rekt/
Learn to Prevent the Next Warp Finance
The Warp Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.