<h2 id="header-0">Background</h2>On March 14, 2024, according to an alert from the SlowMist MistEye security monitoring system, the decentralized lending protocol MOBOX on the Optimism blockchain was attacked, resulting in a loss of approximately $750,000. The SlowMist Security Team has conducted an in-depth analysis of this incident and shares their findings as follows:<img src="https://miro.medium.com/v2/resize:fit:579/0*sqQIZesaHIk7HMJW" /><h2 id="header-1">Related Information</h2>Attacker Addresses:<ul><li>0x4e2c6096985e0b2825d06c16f1c8cdc559c1d6f8</li><li>0x96f004c81d2c7b907f92c45922d38ab870a53945</li></ul>Attacked Contract Address:<ul><li>0xae7b6514af26bcb2332fea53b8dd57bc13a7838e</li></ul>Attack Transaction:<ul><li>0x4ec3061724ca9f0b8d400866dd83b92647ad8c943a1c0ae9ae6c9bd1ef789417</li></ul><h2 id="header-2">Attack Method:</h2>The core of this attack involved two main aspects. First, the attacker exploited a vulnerability in the contract’s &#96;borrow()&#96; function, which triggered a reward distribution to the referrer’s address each time it was called. The calculation of the reward was based on the amount of tokens transferred, allowing the attacker to increase the amount of the next loan by transferring the reward back to the attacked contract. Second, each call to the &#96;borrow()&#96; function burned a portion of the MO tokens in the pool, continuously driving up the price of MO tokens. As a result, the attacker was able to profit by repeatedly borrowing and stacking rewards.<h2 id="header-3">Transaction Analysis</h2>The entire attack process primarily involved repeatedly exploiting a vulnerability by cyclically calling the flawed &#96;borrow()&#96; function, immediately followed by redeeming the loan through the &#96;redeem()&#96; function, and then transferring the tokens allocated as a referral bonus back to the attack contract.<img src="https://miro.medium.com/v2/resize:fit:700/0*1Nvvyjhzm3Ngw6gQ" />On closer analysis of the &#96;borrow()&#96; function, it is observed that each call to this function resulted in the burning of a portion of MO tokens from the pool.<img src="https://miro.medium.com/v2/resize:fit:700/0*hHWPLA8j7rw_zozJ" />However, the amount of USDT loaned was calculated based on the price of the MO tokens in the pool. As the burning of MO tokens continuously increased their price, the attacker was able to borrow a large amount of USDT with only a small quantity of MO tokens.<img src="https://miro.medium.com/v2/resize:fit:700/0*QL-eWssS8M-o7be2" />Moreover, each borrowing action awarded a dividend reward to a referrer’s address, and the size of this reward was calculated based on the amount of MO tokens provided.<img src="https://miro.medium.com/v2/resize:fit:700/0*dTxPkwfpIzSIgV8N" />Since the referrer’s address was also controlled by the attacker (&#96;0x96f004c81d2c7b907f92c45922d38ab870a53945&#96;), the attacker was able to transfer the reward back after each loan transaction, thus amplifying the amount and rewards for subsequent loans.<img src="https://miro.medium.com/v2/resize:fit:700/0*Grd9iKzc0O6FzcdY" />Through these cyclic operations, the attacker was able to inflate the price of MO tokens significantly. Ultimately, with only a small amount of MO tokens, the attacker could borrow large sums of USDT from the contract and then exchange all the USDT in the now unbalanced pool for a profit.<img src="https://miro.medium.com/v2/resize:fit:700/0*dCUs5ljxOCPAtIRF" /><h2 id="header-4">Summary</h2>The core of this attack was the exploitation of the &#96;borrow()&#96; function’s mechanism, where part of the tokens in the pool were burned, continually borrowing assets to inflate the price of the tokens in the pool and gaining referrer rewards. The attacker then transferred these tokens back to themselves to borrow again, thus continuously stacking rewards and manipulating prices. The SlowMist Security Team recommends that project developers include lock-up period restrictions in similar functional routines and consider a variety of factors when designing the lending price model to prevent similar incidents from occurring.<h3 id="about-slowmist">About SlowMist</h3>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.We offers a variety of services that include but are not limited to security audits, threat intelligence, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) solutions, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we wish to help spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

Analysis of the MOBOX Security Breach

Table of Contents

SlowMist

Other articles published on Mar 21, 2024

US Lawmakers Approach Crucial Vote on Stablecoin Regulation

OpenSea Unveils Seaport 1.6 for Next-Gen NFT Markets

US lawmakers are hopeful about approving crypto regulations before the upcoming November elections

Navigating Trustlines on XRPL: An Essential Guide for Sceptical XRP Holders

BlackRock BUIDL Platform Stained By 0.97 ETH Tornado Cash Inflow

Why Missing Out on NFTFN’s 300x Altcoin Presale Opportunity Could Cost You

Join our free newsletter for daily crypto updates!