HACK ANALYSIS 2 min read

Anji Eco Hack Analysis — Improper Upgrades

Overview:

On March 17, 2023, Anji Eco’s contracts were hacked due to flaws in the upgrade contract system, causing Anji Network users to lose 120 WBNB.

Smart Contract Hack Overview:

AnjiEco’s Contract Code: 0xfc619ff
Attacker’s address (previous UF DAO hacker): 0xc578d755
Attacker’s Transaction: 0xe3d1f20
Flashloan Receiver’s Address: 0x1609443
Vulnerable SPND-ANJI contract code: 0x5ba41ea
DPPAdvanced Flashloadn Contract: 0x81917e
PancakeSwap Contract: 0xfbf772
SPND Contract code: 0x75e3c

Decoding the Smart Contract Vulnerability

The attacker launched the attack by taking a flashloan of 34 WBNB from the DPPAdvanced contract and swapping it through pancake swap for its SPND counterpart, about 799k SPDN tokens.

The attacker executed the SPND-ANJI Upgrade function and approved the SPND token for the ANJI contract, which resulted in the approval of SPND tokens for their ANJI token equivalent.

The attacker then used PancakeSwap Router V2 to exchange the ANJI tokens for their WBNB counterpart, which resulted in the addition of 154 WBNB tokens to the attacker’s account.

The attacker then finished the flash loan, returned the 34 WBNB flash loan amount to the DPP Advanced contract, and transferred the remaining 120 WBNB to their wallet.

Mitigation and best practices:

Price manipulation attempts can be mitigated to a greater extent via oracles such as Chain Links and input validation on those feed parameters to prevent stale data.
Check for instances of fraudulent deposits on a regular basis and prevent arbitrage.
Ensure that all code is open to the public and is thoroughly audited.
Check often for instances of fraudulent deposits.
To stop price manipulation attempts, implement validations on transaction variables and securely revoke transactions containing fraudulent deposits and transfers
To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://credshields.com/
Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detection at SolidityScan including access control vulnerabilities.

SolidityScan — Smart Contract Vulnerability Scanner

Conclusion:

SolidityScan is an advanced smart-contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup

Anji Eco Hack Analysis — Improper Upgrades