Cointime

Cointime

Download App
iOS & Android

SharkTeam：Woo Finance被攻击事件分析

2024年3月5日，Woo Finance部署在Arbitrum上的合约遭受闪电贷攻击，损失约850万美元。此前，2月23日，Woo Finance部署在Ethereum上的合约就曾被攻击，损失约3,891美元，很显然黑客团队将Woo Finance作为攻击目标进行了系统化的漏洞挖掘，非常可惜Woo Finance没有能及时对多链合约的安全性进行全面检查，没能阻止这次攻击。

SharkTeam对此事件第一时间进行了技术分析，并总结了安全防范手段，希望后续项目可以引以为戒，共筑区块链行业的安全防线。

一、攻击交易分析

攻击者地址：

0x9961190b258897bca7a12b8f37f415e689d281c4

攻击合约：

0x1759f791214168e0292ab6b2180da1c4cf9b764e

0xc3910dca5d3931f4a10261b8f58e1a19a13e0203

0xd4c633c9a765bc690e1fba566981c1f4eab52df0

0x66634590d7d631e3bf85ef4cd6c89ca7479e22bc

0x27a116a48c6dd23fc005ea6ea02847723d5b3856

0x2458464afec10e973ac61860718328ce8358be3a

被攻击合约：

0xeff23b4be1091b53205e35f3afcd9c7182bf3062

攻击交易：

0x57e555328b7def90e1fc2a0f7aa6df8d601a8f15803800a5aaf0a20382f21fbd

0x40e1b8c78083fc666cb7598efcecd0ae0af313fc41441386e4db716c2808ce07

0xe80a16678b5008d5be1484ec6e9e77dc6307632030553405863ffb38c1f94266

攻击流程：

1. 以第一笔攻击交易为例，攻击合约（0x1759f791）通过闪电贷借取10580749枚USDC.e代币和2704558枚WOO代币。

2. 后通过在Silo合约中抵押7000000枚USDC.e代币,借出了5092663枚WOO代币，再将2000000枚USDC.e代币兑换成了WETH。

3. 攻击合约（0x1759f791）将100000枚USDC.e兑换为173684枚WOO，并略微抬高WOO的价格。

4. 攻击合约（0x1759f791）用7856868枚WOO代币在被攻击合约（0xeff23b4b）中兑换为2246892枚USDC.e，并将合约中WOO代币的价格从578535. 在价格被更改后，攻击合约（0x1759f791）仅用0.9枚USDC.e就换出了10232908枚WOO。

5. 在价格被更改后，攻击合约（0x1759f791）仅用0.9枚USDC.e就换出了10232908枚WOO。

6. 攻击合约（0x1759f791）归还silo中借出的WOO代币提出抵押的USDC.e代币并归还闪电贷函数，最后获利559枚ETH和2549710枚WOO。

攻击的本质是合约的价格计算式中参数可以被黑客操控，导致WOO代币的价格被操纵。被攻击合约（0xeff23b4b）中_calcQuoteAmountSellBase对价格进行计算时逻辑出现漏洞。

价格计算式中的baseAmount以及state.price都可以被操控，攻击者（0x9961190b）在第三步时抬高了一些stake.price，第四步使用大量WOO代币进行兑换，导致baseAmount参数很大，由于红框中计算的结果作为减数存在，所以当红框计算结果越大，newPrice参数越小，使得兑换结束后price值被设定为了9。价格比例严重失衡，使用极少USDC.e即可换出大量WOO代币。

针针对本次攻击事件，我们在开发过程中应注意以下事项：

1. 开发者在设计价格计算式时，应严格考虑参数是否会被操控的问题。

2. 项目上线前，需要通过专业的第三方审计团队进行智能合约审计。

About Us

SharkTeam的愿景是保护Web3世界的安全。团队由来自世界各地的经验丰富的安全专业人士和高级研究人员组成，精通区块链和智能合约底层理论。提供包括风险识别与阻断、智能合约审计、KYT/AML、链上分析等服务，并打造了链上智能风险识别与阻断平台ChainAegis，能有效对抗Web3世界的高级持续性威胁(Advanced Persistent Threat，APT)。已与Web3生态各领域的关键参与者,如Polkadot、Moonbeam、polygon、Sui、OKX、imToken、Collab.Land等建立长期合作关系。

官网：https://www.sharkteam.org

Twitter：https://twitter.com/sharkteamorg

Telegram：https://t.me/sharkteamorg

Discord：https://discord.gg/jGH9xXCjDZ

Comments

All Comments

Recommended for you

  • US Spot Ethereum ETF Sees Net Outflow of $4.93 Million

    On June 13, according to monitoring by Trader T, the US spot Ethereum ETF experienced a net outflow of $4.93 million yesterday.

  • US Spot Bitcoin ETF Sees Net Inflow of $85.82 Million Yesterday

    On June 13, according to monitoring by Trader T, the US spot Bitcoin ETF recorded a net inflow of $85.82 million yesterday.

  • U.S. Bans Foreign Access to Fable 5 and Mythos 5; Anthropic Issues Detailed Rebuttal

    On June 13, Anthropic issued a statement announcing that the U.S. government, citing national security powers, has released an export control directive requiring the suspension of all access to the AI models Fable 5 and Mythos 5 by foreign entities, regardless of whether the individuals are within the U.S., including Anthropic employees who are foreign nationals. The practical effect of this order is that we must immediately disable access to Fable 5 and Mythos 5 for all customers to ensure compliance. Access to all other Anthropic models will not be affected. We received the government's directive at 5:21 PM (Eastern Time) today. The letter did not specify the details of its national security concerns. Our understanding is that the government believes it has become aware of a method to bypass or 'jailbreak' Fable 5. So far, the government has only provided us with verbal evidence suggesting the existence of a potential narrow, non-general jailbreak, essentially by requiring the model to read specific code libraries and fix any software defects. We are complying with the government's legitimate directive and are in the process of removing all users' access to Fable 5 and Mythos 5. However, we disagree with the conclusion that 'a narrow potential jailbreak vulnerability should be the reason to recall commercial models deployed to hundreds of millions of users.' (Jinshi)

  • Iranian Foreign Minister: Iran-U.S. Memorandum of Understanding May Be Signed in Days

    On June 13, Iranian media reported that Iranian Foreign Minister Amir-Abdollahian stated that once the final stage of negotiations between Iran and the U.S. is completed, the memorandum of understanding will be signed and announced immediately. The first phase will be signed electronically from a distance, "which may happen in the coming days." (Xinhua News Agency)

  • U.S. Officials: U.S. and Iran Close to Agreement, Signing Expected in Coming Days

    On June 13, Reuters reported that a senior U.S. official stated on Friday local time that the U.S. and Iran have not yet truly reached the finish line, but are very close to finalizing an agreement to resolve their conflicts. Washington expects to sign the agreement in the coming days. 'The negotiating team has put us in a very favorable position, but we still need to see, we haven't really reached the finish line, but we are very close,' the U.S. official said. The official noted that the agreed terms achieve a core goal of Trump. The memorandum of understanding includes the reopening of the Strait of Hormuz and the lifting of U.S. blockades on Iranian ports. Iran's highly enriched uranium will also be destroyed on-site and subsequently removed from the country. 'Iran will not gain anything from signing the memorandum or from the negotiations themselves,' the official said. 'They will receive economic rewards for fulfilling the obligations set forth in the agreement. Therefore, if they commit to handing over nuclear materials, they will gain something. If they dismantle their nuclear program or facilities, they will receive additional benefits.'

  • Iran's Foreign Ministry: Iran is Reviewing Draft Memorandum of Understanding

    On June 13, local time on the 12th, Iranian Foreign Ministry spokesperson Baghaei stated that Iran and the United States have reached an understanding on most issues, and Iran is currently in the final stages of compiling the text of the memorandum of understanding. Therefore, the previous statement by Iranian Foreign Minister Amir-Abdollahian that 'the two sides are very close to reaching an understanding' is accurate and noteworthy. Meetings of relevant decision-making bodies are ongoing, and this is a process that is being continuously advanced. To achieve a final and decisive outcome, consensus must be formed among decision-making bodies and relevant departments. Baghaei also mentioned that various speculations regarding the content of the agreement text have not been confirmed. Although specific details of the diplomatic process cannot be publicly discussed at this time, this does not mean that the public does not have the right to be informed. (CCTV News)

  • SpaceX Opens at $150 on First Day of Trading, IPO Price Set at $135

    On June 12, SpaceX opened at $150 on its first day of trading, with an IPO price set at $135.

  • Iranian Foreign Minister Claims Iran and US 'Have Never Been Closer' to Memorandum of Understanding

    On June 12, Iranian Foreign Minister Amir-Abdollahian stated on social media that Iran and the US 'have never been closer' to reaching a memorandum of understanding. He urged the media to refrain from speculating on its contents before finalization. The Iranian side will disclose all details in due course. (CCTV News)

  • BTC Surpasses $64,000

    Market data shows that BTC has surpassed $64,000, currently priced at $64,107.99, with a 24-hour increase of 2.18%. The market is experiencing significant volatility, so please ensure proper risk management.

  • ARM Soars Nearly 10%, Bank of America Predicts Server CPU Market to Quadruple by 2030

    On June 12, ARM surged nearly 10%, reaching $376.18. According to a recent forecast by Vivek Arya, an analyst at Bank of America Global Research, the total addressable market (TAM) for server CPUs is expected to skyrocket from $35 billion in 2025 to over $170 billion by 2030. This significantly exceeds the bank's previous prediction of a $125 billion market size for server CPUs by 2030. Arya stated in the report, 'We believe the rise of agent-based AI is a powerful demand accelerator that not only expands the market opportunities for CPUs but also benefits Intel, AMD, and challengers based on Arm architecture.'

Daily Must-Read

Popular Activities

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

April 30 - April 30
Dubai

Popular Tags

Cointime
News
Contents
RSS
Company