On June 1, 2023 Cellframe experienced a flash loan attack, resulting in a 41.2% decline in the price of Cellframe ERC20 v2. We promptly carried out an investigation and uncovered the following information:<h2 id="header-0">Relevant Information:</h2>Attacker’s address:0x2525c811EcF22Fc5fcdE03c67112D34E97DA6079Attacker’s contract address:0x1e2a251b29e84e1d6d762c78a9db5113f5ce7c48Attack transaction: 0x943c2a5f89bc0c17f3fe1520ec6215ed8c6b897ce7f22f1b207fea3f79ae09a6Attacker’s LP(OLD) addition transaction: 0xe2d496ccc3c5fd65a55048391662b8d40ddb5952dc26c715c702ba3929158cb9<h2 id="header-1">Preliminary Information:</h2>In this attack, various new and old contracts were implicated. To facilitate the analysis of this incident, we will designate the parameter names of the new and old contracts within the LpMigration contract as their respective contract names.address OLD_CELL: 0xf3E1449DDB6b218dA2C9463D4594CEccC8934346address LP_OLD: 0x06155034f71811fe0D6568eA8bdF6EC12d04Bed2address CELL: 0xd98438889Ae7364c7E2A3540547Fad042FB24642address LP_NEW: 0x1c15f4E3fd885a34660829aE692918b4b9C1803d<img src="https://miro.medium.com/v2/resize:fit:700/0*2xM47aj2MqsWQnvE"><h2 id="header-2">Detailed Analysis:</h2>1. The attacker executed a flash loan of 1000 BNB using DODO’s DPPOracle.2. The attacker performed a flash loan of 500,000 CELL tokens through PancakeSwap V3.3. In the PancakeSwap V2 LP_NEW pool, the attacker converted the entire 500,000 CELL tokens acquired through the flash loan into 50 BNB. As a result, the BNB balance in the LP_NEW pool decreased to 8, while the CELL token balance remained at 550,000.4. Following that, the attacker exchanged 900 BNB for OLD_CELL tokens in LP_OLD, a separate PancakeSwap V2 pool. During this phase, the LP_OLD pool had a balance of 902 BNB and only 7 OLD_CELL tokens.5. After converting BNB to OLD_CELL, it was noted that the attacker directly called the migrate function of the LpMigration contract to trigger LP migration. Curiously, in our earlier analysis, the attacker did not undertake any steps to acquire LP tokens. Hence, the source of these LP tokens raises a question.6. Upon revisiting the attack contract, examination of the preceding transaction unveiled that the attacker injected liquidity into the LP_OLD pool during the process, consequently obtaining LP(OLD) tokens.<img src="https://miro.medium.com/v2/resize:fit:700/0*O0ippRRCkwDkODnf">7. The attacker executed a sequence of successive migrate operations on the LP(OLD) within the LP_OLD pool, with the following details:Initially, the attacker called the migrateLP function to withdraw liquidity from the LP(OLD) and return the tokens to the respective users. As the LP_OLD pool contained a significant amount of BNB tokens, removing liquidity resulted in an increased calculated BNB amount while reducing the quantity of OLD_CELL tokens. Subsequently, within the LP_NEW pool, the getReserves function was employed to obtain the quantities of BNB and CELL tokens. Due to previous swap operations, the LP_NEW pool had fewer BNB tokens and a higher number of CELL tokens. This discrepancy caused the resulting value of “result” to be inflated, leading to an overestimated token1 value for the newly calculated CELL tokens.<img src="https://miro.medium.com/v2/resize:fit:700/0*EtSnCfkSj3rGayAF">8. It is of utmost importance to emphasize that the LpMigration contract already held CELL tokens. Consequently, the token1 token (CELL) employed by the attacker to provide liquidity originated from within the LpMigration contract itself. Subsequently, the calculated results were added as liquidity to the ROUTER_V2 pool. (PS: This also explains why, following the attack, Cellframe: Deployer would utilize the withdrawCELL() function to recover all the CELL tokens from the contract.)<img src="https://miro.medium.com/v2/resize:fit:700/0*L2Mhb3BVhN929lqi">9. In essence, the attacker took advantage of the abundance of BNB and scarcity of OLD_CELL tokens in the LP_OLD pool to optimize their BNB gains through liquidity removal. Conversely, in the LP_NEW pool, where BNB was scarce and CELL tokens were abundant, the attacker could provide liquidity using a small amount of both BNB and CELL tokens. By conducting multiple migrate operations, the attacker successfully generated profits from these favorable conditions.<img src="https://miro.medium.com/v2/resize:fit:700/0*ckcnZnjLMgJwC7bx">10. In the end, the attacker withdrew liquidity from the LP_NEW pool and converted the OLD_CELL tokens from the LP_OLD pool into BNB. Subsequently, the attacker utilized a newly created CELL-BUSD pool to convert the tokens into BUSD, which were then exchanged for BNB to repay the FlashLoan. This series of actions resulted in the attacker earning a profit of 245.522826177178247245 BNB.<h2 id="header-3">Summary</h2>The essence of this attack revolves around exploiting liquidity migration calculations. The attacker skillfully manipulated the liquidity in two distinct pools, causing an intentional imbalance, and effectively engaged in arbitrage activities.About SlowMistSlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.Website：<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">https://www.slowmist.com</a>Twitter：<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">https://twitter.com/SlowMist_Team</a>Github：<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">https://github.com/slowmist/</a>

SlowMist: A Brief Analysis on the Cellframe Hack

Table of Contents

SlowMist

Other articles published on Jun 6, 2023

Atomic Wallet Hack: $35 Million Stolen, Recovery Efforts Underway

SEC Accuses Binance and CEO of Mishandling Funds

SUPER CHEAP Solana NFTs That Can Make You RICH

BTC Crashes Below $26000, Ethereum reserves at multi-year lows

Crypto Twitter abuzz with Coinbase banter after SEC lawsuit

Polygon (MATIC) Sees 742% Surge in Big Moves as Whales React to New Development

Join our free newsletter for daily crypto updates!