On May 14, 2022, loser coin ($lowb) experienced a flash loan attack, leading to approximately ~$10K USD worth of asset loss. The root cause is that the Pancake LP’s reserves are directly used as the price feeder for their LUSD contract, thus allowing the attacker to manipulate the price via flash loan.
TL;DR
On May 14, 2022, loser coin ($lowb) experienced a flash loan attack, leading to approximately ~$10K USD worth of asset loss. The root cause is that the Pancake LP’s reserves are directly used as the price feeder for their LUSD contract, thus allowing the attacker to manipulate the price via flash loan.
Introduction
On May 14th, 2022 at approximately 2:05 PM UTC, an attacker exploited loser coin for 10,415 USDT by manipulating the $lowb price with a flash loan, causing the token to undergo a price slippage of over 50.75%. The Pancake LP’s reserves are directly used as the price feeder for their LUSD contract. As a result, the attacker was able to manipulate the price via flash loan.
On the day of the attack, the loser coin team took to Twitter, acknowledging the attack and where the vulnerabilities remained. A total of 3 loser coin users were affected by the attack. On May 15th, 2022, the loser coin team deployed a new contract address and paid a 1:1 compensation to the users who suffered loses. Loser coin continues to have an active community, with a current presence on Twitter, Telegram, Reddit, and their website. Since the attack loser coin has migrated from BSC to ETH.
Attack Flow
-
The attacker borrowed 100,000 BSC-USD from DLP.
-
The attacker then swapped the borrowed 100,000 BSC-USD to 1,475,966,814 loser coins in LP Pair 0x3642b52519ba81fd8a204b306d2369a0cc1bc612.
-
As the minted amount of LUSD is determined by the price of the loser coin in the LP Pair, the attacker was able to mint more LUSD with the tilted price.
a. After the swap in step 2, the price of loser coin became ~ 0.000094 b. The attacker transferred 1,066,207,113 loser coins to the LUSD token and minted for 100,000 LUSD token. The attacker swapped back 409,759,700 loser coins for 34,739 BSC-USD to decrease the price of loser coin in the LP Pair.
- The attacker burnt LUSD for loser coin with the decreased price of loser coin:
a. After step 4, the price of loser coin was ~ 0.000076 b. 100,000 LUSD was burnt for 1,298,665,258 loser coin
- The attacker then swapped all the loser coins for BSC-USD for profit and repaid the flash loan.
Exploit Transactions
Loser coin(lowb) contract address:
https://bscscan.com/address/0x843d4a358471547f51534e3e51fae91cb4dc3f28
Pancake LP Pair:
https://bscscan.com/address/0x3642b52519ba81fd8a204b306d2369a0cc1bc612
Addresses Current LOWB token contract after migrating to Ethereum:
https://etherscan.io/address/0x69e5c11a7c30f0bf84a9faecbd5161aa7a94deca
New LUSD contract address:
https://bscscan.com/token/0x03d9a687c0dab6f68bbee8179a50f8ead60b4959
LUSD token contract:
https://bscscan.com/address/0x03d9a687c0dab6f68bbee8179a50f8ead60b4959#code
Attacker:
https://bscscan.com/address/0x450b8d3bae2be87151a380e1549a51162c97b87c
Attacker Contract:
https://bscscan.com/address/0x0e2e6ccb3250455d73f8f1925e996cffce6557f3
Victim Address #1:
https://bscscan.com/tx/0x3165acf35a9dad30b613f03cbc09865ea71943de95fa296b29053a1de71f2808
Victim Address #2:
https://bscscan.com/tx/Oxf97e5f6e94efa26d73e259d89682b0cac9056e85922968cee5375ec804510bcd
Victim Address #3:
https://bscscan.com/tx/Oxd3cbd628eab9e79300b86fd4b8a3c913b09261a63cfb21c3f16a5e0089612625
Profit and Assets Tracing
In total approximately 10,415 USDT (~10,000 USD) was lost, which has been sold for 37.89 BNB and 36.3 BNB was transferred out of the attackers wallet to Tornado cash. According to a statement from the loser coin team, a total of 3 loser coin holders suffered a loss from the exploit:
OxC305fbD57dF739d287AD2D365a89e5f3338d6F8A ~67 LUSD
0x587A1E14E44bb349e05dfAda2eBE7FA86eC3d1b3 ~3 LUSD
0x4696Af23d8590Da064645B83a22AD775906B
With the new loser coin contract deployed, the effected users were paid 1:1 compensation.
Contracts Vulnerability Analysis
The vulnerability stems from the Oracle design flaw in the LUSD token’s “minting” and “burning” logic.
The LUSD token contract can swap between the loser coin and LUSD with the mint and burn based on the current price in the Pancake Swap LP. Therefore, the attacker is able to manipulate the price for profit.
Following the flash loan attack, the loser coin team took to twitter to make a statement regarding the vulnerability exploited during the attack. The team stated they were aware of the loophole and would be fixing the bug urgently, releasing a new contract once it was fixed. On May 15th, 2022 the loser coin team announce an updated lusd contact address for compensation that is no longer in use (0xF2eaF92A14B2EDDdC089BB5120D6A13c872e6b4a).
Conclusion
Overall, loser coin was hacked for roughly ~$10,000 due to a vulnerability where Pancake LP’s reserves are directly used as the price feeder for their LUSD contract. As a result, the attacker was able to manipulate the price via flash loan. Just a few days after the flash loan attack, loser coin migrated from BSC to ETH in order to decrease risk of flash loan attacks (0x69e5c11a7c30f0bf84a9faecbd5161aa7a94deca). As of today, loser coin continues to have an active social media presence on Twitter, Telegram, Reddit, and their website.
