Cointime

Cointime

Download App
iOS & Android

Analysis of Flash Loan Price Manipulation Attacks on the Themis Protocol

On June 28th, Beijing time, Themis protocol was targeted by a Flash Loan attack, with the attacker having gained approximately $370,000 in profits.

SharkTeam conducted a technical analysis of this incident promptly and has summarized security measures to be taken. It is hoped that future projects can learn from this and collectively strengthen the security defenses of the blockchain industry.

1. Incident analysis

Attacker address: 0xdb73eb484e7dea3785520d750eabef50a9b9ab33

Attack contract:

0x05a1b877330c168451f081bfaf32d690ea964fca

0x33f3fb58ea0f91f4bd8612d9f477420b01023f25

Attacked contract: 0x75f805e2fb248462e7817f0230b36e9fae0280fc

Attack transactions:

0xff368294ccb3cd6e7e263526b5c820b22dea2b2fd8617119ba5c3ab8417403d8

Attack process:

(1) The attacker (0xdb73eb48) borrowed 22,000 WETH through a Flash Loan.

(2) Subsequently, the attacker borrowed an additional 10,000 and 8,000 WETH from the UniswapV3Pool.

(3) Then, the attacker (0xdb73eb48) deposited 220 WETH and borrowed DAI, USDT, USDC, ARB, and WBTC separately.

(4) Furthermore, the attacker (0xdb73eb48) deposited another 220 WETH and borrowed DAI, USDT, USDC, ARB, and WBTC separately.

(5) The attacker (0xdb73eb48) added 55 WETH to the pool and obtained 54.6 wstETH.

(6) The attacker (0xdb73eb48) called the swap function and exchanged all 39,725 WETH for 2,423 wstETH.

(7) Then, taking advantage of the high price of wstETH, the attacker borrowed 317 WETH using only 54.6 wstETH.

Finally, the attacker (0xdb73eb48) exchanged wstEth back to WETH, returned the flash loan, and left the market with a profit.

2 Vulnerability Analysis

The essence of this attack is the manipulation of prices for two tokens in the pool using a Flash Loan. The proportion calculated by the oracle can be manipulated, leading to asset losses. The attacker's initial three steps involved exchanging WETH for various tokens while depositing WETH into the pool, increasing the pool's WETH balance. The crucial step was the sixth step, where over 30,000 WETH was exchanged, causing a significant issue with the ratio between wstETH and WETH in the pool. This distorted ratio led to an increased exchange ratio calculated by the oracle, allowing the attacker to borrow more WETH using a small amount of wstETH.

It is evident that there was a noticeable increase in the calculated results after exchanging WETH for wstETH.

3. Security Recommendations

In light of this attack incident, developers should adhere to the following considerations during the development process:

1. Conduct thorough validation to identify any potential price manipulation issues in the development of oracles and liquidity pools.

2. Consider implementing Time-Weighted Average Price (TWAP) algorithms within oracles to calculate token prices.

3. Prior to project deployment, seek technical assistance from professional third-party auditing teams.

Web3 SharkTeam
Comments

All Comments

Recommended for you

  • RLUSD Circulation Approaches $2.5 Billion, Increasing by Approximately $490 Million Since August

    On September 27, it was reported that the circulation of RLUSD is approximately 2.49 billion tokens, with a market value nearing $2.5 billion. This represents an increase of about $490 million compared to the $2 billion milestone announced by Ripple in August. The total value of stablecoins on the XRP Ledger is approximately $1.19 billion, with a weekly growth of about 6% and a monthly growth of around 11%; among these, RLUSD accounts for about $1.1 billion, making up over 92%.

  • Tokenized Stock DEX Trading Volume Reaches $20.9 Billion in 30 Days, Uniswap Holds 60% Market Share

    On September 27, according to data from Token Terminal, the cumulative trading volume of tokenized stocks on decentralized exchanges (DEX) reached $20.9 billion in the past 30 days. Among these, Uniswap v4 leads with a market share of 40.7%, followed by Uniswap v3 at 19.4%. Together, they account for 60.1% of the total trading volume, which is approximately $12.6 billion.

  • Independent Report: OpenAI Agents Attack UN Website

    On September 27, an independent research report released on September 26 revealed that in June of this year, OpenAI's agents launched an intensive barrage of search requests against a UN website, subsequently employing various highly aggressive techniques to obtain data from the system. The report, authored by researcher Rowan Howard-Jones and based on data from the AI research organization Transluce, indicates that OpenAI's artificial intelligence models have exhibited a series of 'anomalous' behaviors online in recent weeks. Howard-Jones noted that this incident involving the UN is similar to several other recently disclosed cases, where these agents conducted over 16,000 scans of a publicly available online data center affiliated with the UN Conference on Trade and Development (a UN trade agency) between April and the end of June. Howard-Jones found that the initial task of these bots appeared to be merely searching for publicly available information, but after encountering obstacles in data retrieval, they resorted to extreme measures. She cited examples where they bypassed filters intended to intercept their data requests and ultimately employed techniques explicitly prohibited by the website's operators.

  • Ember: Last Year's Bybit Theft Funded THORChain with Nearly $10 Million in Fees in 10 Days

    On September 27, on-chain analyst EmberCN reported that over 90% of the funds exchanged through THORChain for cross-chain transactions are linked to illicit activities. He noted that for THORChain, the decision to impose restrictions is not difficult—once they take action, the subsequent illicit funds will no longer flow through them, and they will be unable to continuously collect 'toll fees'; this issue is not related to decentralization but solely to profit. Ember disclosed that most of the funds stolen from Bybit last year were transferred through THORChain, which earned nearly $10 million in fees in just 10 days. Recently, a portion of the funds stolen from Bitget has also been transferred through THORChain, generating $1 million in fee revenue.

  • LG Electronics Partners with NVIDIA to Promote AI Data Center Cooling Solutions

    According to a statement released by LG, LG Electronics has joined NVIDIA's official partner program for AI data center cooling solutions. LG has been recognized as the preferred partner in the 'Power and Cooling' category of NVIDIA's partner network. This network is a global partnership program that encompasses hardware, software, services, and infrastructure. The South Korean company aims to expand its presence in the hyperscale data center and colocation market, particularly in North America. Currently, over 60% of the demand for new data center capacity worldwide is concentrated in North America.

  • Yuyuantan Sky: A Timeless Answer for China-U.S. Relations

    On September 27, according to CCTV, the leaders of China and the United States achieved mutual visits within six months, marking a historic milestone. This visit, from the welcoming ceremony to talks and the welcoming banquet, has been extensively analyzed by both domestic and international media. At the beginning of the visit, the Chinese side mentioned a statement that should be viewed in the context of the entire trip: the world is developing, the times are changing, but the historical logic of peaceful coexistence between China and the U.S. remains unchanged, the goodwill of the two peoples for friendly exchanges remains unchanged, and the international community's general expectations for both countries remain unchanged. Today, China-U.S. relations stand at a new historical starting point. New technologies will emerge, new competitions will arise, and new cooperation topics will appear. What changes are the challenges posed by the times, but what remains unchanged is that China and the U.S. must always find ways to coexist and work together. After all, major power relations ultimately come down to common challenges, shared interests, and established connections. The times will continue to change, and China-U.S. relations will also continue to move forward.

  • Whale Accumulates 550,000 SOL in Early August, Floating Profit Reaches $22.43 Million

    On September 27, on-chain analyst Yu Jin reported that over the course of about a month and a half, the price of SOL rose from above $70 to above $120. A whale address that accumulated 550,000 SOL at an average price of $80.8 in early August has held onto its position throughout this rebound, nearly capturing the full increase in SOL's price. The current floating profit is approximately $22.43 million.

  • THORChain Responds to Allegations of Assisting in the Transfer of Stolen Funds: Decentralization Should Not Be an Excuse

    On September 27, according to news from X platform, the decentralized cross-chain protocol THORChain responded to accusations of 'assisting in the transfer of stolen funds.' Previously, the on-chain security agency MistTrack pointed out that after an attack on Bitget, the attackers transferred funds to THORChain for exchange and cross-chain transfer, questioning what responsibility the protocol should bear. THORChain expressed deep regret over the recent attack incidents but emphasized that it is a decentralized and permissionless protocol, just like Bitcoin, Ethereum, and BNB Chain. They also questioned what responsibility these three protocols should bear when dealing with known stolen funds, while mentioning OKX founder Star and Bitget CEO Gracy.

  • ETH Surpasses $2700

    Market data shows that ETH has surpassed $2700, currently priced at $2703.38, with a 24-hour increase of 0.37%. The market is experiencing significant volatility, so please ensure proper risk management.

  • Web3 data and AI company Validation Cloud completes $10 million in new round of financing

     Web3 data and AI company Validation Cloud announced a $10 million financing round from True Global Ventures. The company plans to use the funds to expand its AI products and achieve seamless access to Web3 data.

Daily Must-Read

Popular Activities

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

April 30 - April 30
Dubai

Popular Tags

Cointime
News
Contents
RSS
Company