What happened
On June 20, 2022, Whale Finance's stablecoin AMM contracts were exploited twice for about $12,000. A scaling error in the stable-pair invariant check allowed the attacker to call swap and withdraw USDT, BUSD, and USDC with an inadequate return amount; the DEX was taken down for assessment.
How it happened
- The attacker called swap on the USDT-BUSD stable AMM using the pool's 5,964 USDT balance as input.
- It returned only 0.6 USDT, but the invariant validation passed because the stable-pair calculation and its scaling factor were inconsistent.
- The contract transferred 5,964 USDT; equivalent calls then withdrew 5,947 and 62 BUSD.
- The attacker repeated the strategy against the USDC-BUSD stable AMM and the analysis reports total profit of about $12,000.
Protocol details
Classification
Borrowing and Lending
Protocol Type
Reserve Currency
Affected asset / contract
HUMP
Protocol links
Website
@WhaleLoans
Security review history
- BlockSec View report
Evidence
- report Report certik.com
- analysis Whale Loans Incident Analysis certik.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
