Ocean Life token hack analysis — Flash Loan Attack
Ocean Life token hack analysis — Flash Loan Attack
Overview:
On April 19, 2023, the Ocean Life token on BSC was hacked. The attacker used a flawed mechanism to lower the overall token supply and manipulate the price, earning 32 WBNB in return.
Smart Contract Hack Overview:
- Attackers transaction:0xa21692
- Attacker address:0xfb8e
- Stolen funds address: 0x662D
- OcenaLife Contract code: 0xb5a0c
- Vulnerable code:0xb5a0
Decoding the Smart Contract Vulnerability:
- The attacker borrowed 969 WBNB in a flashloan from DPPOracle, then used PancakeSwap to convert the WBNB tokens to OLIFE tokens.
- The ‘
_reflectFee’ function was internally called by the transfer function, which decreased the total value of _tTotal.
- The balance of the pool was much higher after accumulation, when computed using
balanceOf(), and the hacker, used the direct call to swap to withdraw $WBNB from the pool.
- The attacker then returned the 969 WBNB flashloan and transferred the 32 WBNB profit to another address.
Mitigation and Best Practices:
- Always ensure that any state changes occur internally first, such as updating balances or calling internal functions before calling external code.
- Price manipulation attempts can be mitigated to a larger extent via oracles such as Chain Links and input validation on those feed parameters to prevent stale data
- To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://credshields.com/
- Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detection at SolidityScan including access control vulnerabilities.
Conclusion:
SolidityScan is an advanced smart-contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup
Follow us on our Social Media for Web3 security-related updates.
SolidityScan — LinkedIn | Twitter | Telegram | Discord