Cointime

Cointime

Download App
iOS & Android

Unraveling the $UN Attack: A Flash Loan Exploits Flaw in Token Contract

Validated Project

On Jun-06-2023, an unfortunate event unfolded as the decentralized finance (DeFi) project, $UN, on the Binance Smart Chain (BSC), fell victim to a targeted attack involving a flash loan. It is a typical skim attack and resulted in a significant loss of $26,000 and showcased a classic skim attack strategy, leaving the UN-LP pair compromised and the price of $UN soaring. Ultimately, the attacker exploited the situation to maximize their profit before swiftly dumping the $UN token. Join us as we unravel the details and explore the implications of this alarming incident.

Attacker

https://bscscan.com/address/0xf84efa8a9f7e68855cf17eaac9c2f97a9d131366

Transaction

https://bscscan.com/tx/0xff5515268d53df41d407036f547b206e288b226989da496fda367bfeb31c5b8b

Attacking Contract

https://bscscan.com/address/0x98e241bd3be918e0d927af81b430be00d86b04f9

Attacked Contract

https://bscscan.com/address/0x5f739a4ade4341d4aee049e679095bccbe904ee1

Asset Loss

$26,000

Attacking Steps

  1. The attacker gets 29,100,000,000,000,001,048,576 BSC-USD by the flash loan from DPPOracle;
  2. Swap 29,100,000,000,000,001,048,576 BSC-USD for 91,391,982,773,176,450,879,376 $UN;
  3. Transfer 84,994,543,979,054,099,317,825 to UN-LP pair;
  4. Call the skim function of the UN-LP pair to send the UN to the attacker. At this point 2,307,601,869,031,318,796,481 $UN are transferred out from the UN-LP pair to the UNStake contract, which results in the price of $UN increased;
  5. Repeat step 3 and step 4 to hugely increase the $UN price;
  6. Finally, swap 55,441,019,173,629,144,550,663 $UN for 55,658,707,032,043,243,002,112 BSC-USD and get the profit of 26,558,707,032,043,241,953,536 BSC-USD

Root Cause

The attack on $UN on BSC can be attributed to an inherent flaw within the $UN token contract. This flaw allowed the attacker to exploit a vulnerability that enabled them to transfer $UN tokens from the UN-LP pair, leading to a significant increase in the price of $UN. This flaw in the token contract essentially provided a gateway for the attacker to manipulate the token's value and execute their malicious intentions.

Key Code

PoC

https://github.com/MetaTrustLabs/SmartContractAttackPoC/blob/main/test/UN/UN.t.sol

The attack on $UN on BSC serves as a stark reminder of the evolving challenges faced by the blockchain industry and the importance of robust security measures. As the crypto ecosystem continues to grow and innovate, it is crucial for developers, investors, and users to remain vigilant and proactive in safeguarding their assets.

While incidents like this can be disheartening, they also provide valuable lessons for the community to learn from, prompting further improvements in security protocols and risk mitigation strategies. Through continued efforts in research, development, and education, the blockchain industry can strive towards creating a more secure and resilient ecosystem that empowers individuals and organizations to leverage the transformative potential of blockchain technology.

Keep tuned, stay secure.

Follow Us

Website: metatrust.io

Twitter: @MetaTrustLabs

Comments

All Comments

Recommended for you

  • BTC Surpasses $82,000

    Market data shows that BTC has surpassed $82,000, currently priced at $82,038.65, with a 24-hour increase of 0.31%. The market is experiencing significant volatility, so please ensure proper risk management.

  • ETH Surpasses $2400

    Market data shows that ETH has surpassed $2400, currently priced at $2400.26, with a 24-hour decline of 1.33%. The market is experiencing significant volatility, so please ensure proper risk management.

  • BTC Surpasses $81,000

    Market data shows that BTC has surpassed $81,000, currently priced at $81,016.34, with a 24-hour decline of 1.53%. The market is experiencing significant volatility, so please ensure proper risk management.

  • BTC Falls Below $80,000

    Market data shows that BTC has fallen below $80,000, currently priced at $79,940.09, with a 24-hour decline of 3.44%. The market is experiencing significant volatility, so please ensure proper risk management.

  • Philadelphia Semiconductor Index Set to Lose Over $2 Trillion in Market Value in Seven Trading Days

    The Philadelphia Semiconductor Index is poised to evaporate over $2 trillion in market value within seven trading days.

  • Philadelphia Semiconductor Index Drops 4% to Lowest Level in Nearly a Month

    The Philadelphia Semiconductor Index fell by 4.01% during the day, currently reported at 11,215.37 points. Nvidia dropped by 3.25%, Broadcom fell by 2.87%, Micron decreased by 5.79%, Intel declined by 5.81%, AMD dropped by 6.28%, Qualcomm rose by 0.66%, TSMC fell by 4.37%, and ASML decreased by 3.34%.

  • Philadelphia Semiconductor Index Falls 4% to Lowest Level in Nearly a Month

    The Philadelphia Semiconductor Index dropped 4.01% during the day, currently reported at 11,215.37 points. Nvidia fell by 3.25%, Broadcom by 2.87%, Micron by 5.79%, Intel by 5.81%, AMD by 6.28%, Qualcomm rose by 0.66%, TSMC fell by 4.37%, and ASML dropped by 3.34%.

  • Ripple Prime Launches Perpetual Contract Trading Services for Institutional Clients

    According to Bloomberg, Ripple's main brokerage division, Ripple Prime, is launching perpetual contracts for real-world assets (RWA) aimed at institutional clients, covering over 100 reference markets including stocks, indices, ETFs, and commodities. This product is offered through Trade.xyz on Hyperliquid, continuing Ripple Prime's previous initiative to provide clients with access to cryptocurrency perpetual contract trading.

  • NYC Comptroller Urges Anthropic to Pause IPO Plans

    On October 15, New York City Comptroller Mark Levine stated in an interview that he has written to Anthropic CEO Dario Amodei, urging the company to suspend its planned initial public offering (IPO). In the letter, he called for Anthropic to pause its IPO plans until it can fully and transparently address concerns related to AI safety, governance, and development that the company itself has raised. Levine wrote that the company should focus on mitigating these risks rather than advancing the IPO. Currently, New York City has an investment exposure of less than $10 million in Anthropic through the private market.

  • US September PPI Rises 6.3% Year-on-Year, Exceeding Market Expectations

    The US Producer Price Index (PPI) for September recorded a year-on-year increase of 6.3%, the highest since May 2026, surpassing market expectations of 5.3%. The month-on-month PPI for September was reported at 1.3%, significantly higher than the market forecast of 0.5%. Additionally, US retail sales for September showed a month-on-month increase of 0.8%, also exceeding market expectations.

Daily Must-Read

Popular Activities

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

April 30 - April 30
Dubai

Popular Tags

Cointime
News
Contents
RSS
Company