Cointime

Cointime

Download App
iOS & Android

SharkTeam：Woo Finance被攻击事件分析

2024年3月5日，Woo Finance部署在Arbitrum上的合约遭受闪电贷攻击，损失约850万美元。此前，2月23日，Woo Finance部署在Ethereum上的合约就曾被攻击，损失约3,891美元，很显然黑客团队将Woo Finance作为攻击目标进行了系统化的漏洞挖掘，非常可惜Woo Finance没有能及时对多链合约的安全性进行全面检查，没能阻止这次攻击。

SharkTeam对此事件第一时间进行了技术分析，并总结了安全防范手段，希望后续项目可以引以为戒，共筑区块链行业的安全防线。

一、攻击交易分析

攻击者地址：

0x9961190b258897bca7a12b8f37f415e689d281c4

攻击合约：

0x1759f791214168e0292ab6b2180da1c4cf9b764e

0xc3910dca5d3931f4a10261b8f58e1a19a13e0203

0xd4c633c9a765bc690e1fba566981c1f4eab52df0

0x66634590d7d631e3bf85ef4cd6c89ca7479e22bc

0x27a116a48c6dd23fc005ea6ea02847723d5b3856

0x2458464afec10e973ac61860718328ce8358be3a

被攻击合约：

0xeff23b4be1091b53205e35f3afcd9c7182bf3062

攻击交易：

0x57e555328b7def90e1fc2a0f7aa6df8d601a8f15803800a5aaf0a20382f21fbd

0x40e1b8c78083fc666cb7598efcecd0ae0af313fc41441386e4db716c2808ce07

0xe80a16678b5008d5be1484ec6e9e77dc6307632030553405863ffb38c1f94266

攻击流程：

1. 以第一笔攻击交易为例，攻击合约（0x1759f791）通过闪电贷借取10580749枚USDC.e代币和2704558枚WOO代币。

2. 后通过在Silo合约中抵押7000000枚USDC.e代币,借出了5092663枚WOO代币，再将2000000枚USDC.e代币兑换成了WETH。

3. 攻击合约（0x1759f791）将100000枚USDC.e兑换为173684枚WOO，并略微抬高WOO的价格。

4. 攻击合约（0x1759f791）用7856868枚WOO代币在被攻击合约（0xeff23b4b）中兑换为2246892枚USDC.e，并将合约中WOO代币的价格从578535. 在价格被更改后，攻击合约（0x1759f791）仅用0.9枚USDC.e就换出了10232908枚WOO。

5. 在价格被更改后，攻击合约（0x1759f791）仅用0.9枚USDC.e就换出了10232908枚WOO。

6. 攻击合约（0x1759f791）归还silo中借出的WOO代币提出抵押的USDC.e代币并归还闪电贷函数，最后获利559枚ETH和2549710枚WOO。

攻击的本质是合约的价格计算式中参数可以被黑客操控，导致WOO代币的价格被操纵。被攻击合约（0xeff23b4b）中_calcQuoteAmountSellBase对价格进行计算时逻辑出现漏洞。

价格计算式中的baseAmount以及state.price都可以被操控，攻击者（0x9961190b）在第三步时抬高了一些stake.price，第四步使用大量WOO代币进行兑换，导致baseAmount参数很大，由于红框中计算的结果作为减数存在，所以当红框计算结果越大，newPrice参数越小，使得兑换结束后price值被设定为了9。价格比例严重失衡，使用极少USDC.e即可换出大量WOO代币。

针针对本次攻击事件，我们在开发过程中应注意以下事项：

1. 开发者在设计价格计算式时，应严格考虑参数是否会被操控的问题。

2. 项目上线前，需要通过专业的第三方审计团队进行智能合约审计。

About Us

SharkTeam的愿景是保护Web3世界的安全。团队由来自世界各地的经验丰富的安全专业人士和高级研究人员组成，精通区块链和智能合约底层理论。提供包括风险识别与阻断、智能合约审计、KYT/AML、链上分析等服务，并打造了链上智能风险识别与阻断平台ChainAegis，能有效对抗Web3世界的高级持续性威胁(Advanced Persistent Threat，APT)。已与Web3生态各领域的关键参与者,如Polkadot、Moonbeam、polygon、Sui、OKX、imToken、Collab.Land等建立长期合作关系。

官网：https://www.sharkteam.org

Twitter：https://twitter.com/sharkteamorg

Telegram：https://t.me/sharkteamorg

Discord：https://discord.gg/jGH9xXCjDZ

Comments

All Comments

Recommended for you

  • Amazon Shares Surge 15.2%, Biggest Gain Since 2012

    On July 31, Amazon shares surged 15.2% to $271.255 per share, marking their biggest gain since 2012, with a total market value of $2.92 trillion.

  • US Treasury Secretary Bessent Vows to Track Down Iranian Assets Globally for Terror Victims

    US Treasury Secretary Bessent said the US will actively track down Iranian assets worldwide to ensure compensation funds for victims of Iran-backed terrorist activities. Bessent stated that the US government's military and economic blockade measures against the Iranian regime will continue and will not be relaxed. (Jinshi)

  • Apple Plunges Nearly 10%, Q4 Revenue Guidance Misses Expectations

    On July 31, Apple (AAPL.US) plunged nearly 10% to $300.33, marking its biggest drop since April 2025. In terms of fundamentals, Apple's third-fiscal-quarter revenue rose approximately 16% year-over-year to $109.42 billion, slightly above analyst expectations. Among the details, product revenue came in at $78.68 billion, beating the expected $77.25 billion. However, services revenue—a key driver of its valuation re-rating in recent years—totaled $30.74 billion, missing the consensus estimate of $31.36 billion. Additionally, Greater China revenue reached $18.82 billion, with year-over-year growth slowing to 22%, also below analysts' forecast of $19.58 billion. During the earnings call, Apple guided fourth-fiscal-quarter revenue growth in the range of 9% to 11%, overall below the 12.1% analysts had expected. CFO Parekh noted that component supply constraints would impact iPhone, Mac, and iPad businesses in the fourth fiscal quarter, with currency fluctuations also constraining growth.

  • Three Fed Officials Back Rate Hike, Hawkish Pressure Builds

    On July 31, three Federal Reserve policymakers said that dissenting votes in favor of a rate hike this week stemmed from stubborn inflationary pressures, highlighting rising internal pressure on Fed Chair Warsh to act. In statements released Friday morning, Hammack and Kashkari said they worry that although the current round of price increases may stem from short-term factors such as President Trump's tariff policies and the Iran war, the inflation situation already warrants Fed action. Logan also joined in, saying that even if inflation cools, if the Fed does not raise rates, inflation is unlikely to fully fall back to the Fed's 2% target; without any policy constraints, inflation could continue to run above target until an unexpected shock occurs. Kashkari said that if inflation remains persistently stubborn, he might support a series of rate hikes, not just a single increase, to prevent inflation from becoming further entrenched. He said: "A series of small policy adjustments may be preferable to waiting for developments to unfold and ultimately having to take more forceful action." Hammack said that if the Fed does not tighten policy, price increases could continue to accelerate. She said: "Inflation has been stubbornly above 2% for more than five years, and I have no confidence that it will return to our target on its own." (Jin Shi)

  • US 10-Year Treasury Yield Rises to 4.7388%, Highest Since January 2025

    On July 31, the US 10-year Treasury yield rose to 4.7388%, the highest level since January 2025.

  • Spot Gold Intraday Decline Widens to 2%, at $4,021.08 per Ounce

    On July 31, spot gold's intraday decline widened to 2%, reported at $4,021.08 per ounce.

  • BTC Falls Below $63,000

    Market数据显示，BTC has fallen below $63,000, currently reported at $62,985.99, with a 24-hour decline of 2.99%. Market volatility is significant, please exercise risk control.

  • Fed's Logan: Leaning Toward 25 Basis Point Rate Hike

    On July 31, Federal Reserve Governor Logan said she leans toward a 25 basis point rate hike, believing inflation has not yet entered a sustainable path back to the Fed's 2% target. Logan stated that taking moderate action now would reduce the risk of needing more aggressive tightening in the future, while emphasizing that the Fed cannot rely on unexpected shocks to achieve its inflation target.

  • Fed's Logan: Taking Modest Actions Now Reduces Likelihood of Needing Stronger Action Later

    On July 31, Dallas Fed President Lorie Logan said that taking modest actions in the near term would reduce the likelihood of needing to take stronger action in the future.

  • Philadelphia Semiconductor Index Erases 5% Gain, Turns Lower

    On July 31, U.S. chip and semiconductor stocks rapidly weakened, with the Philadelphia Semiconductor Index wiping out a 5% gain and turning lower. Micron Technology, which had risen 6%, is now down 4.2%. SanDisk, which had gained nearly 10%, is now down over 6%. SK Hynix and Seagate Technology, which had risen over 8%, are now down 2%. TSMC, which had gained 4%, is now down nearly 1%.

Daily Must-Read

Popular Activities

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

April 30 - April 30
Dubai

Popular Tags

Cointime
News
Contents
RSS
Company