Solidity Finance

All data is actual at the time of compiling the report in January, 2023.

Twitter - 21.000 subscribers, ER 0.268%
Approximately the account receives:
43.4 likes per tweet
1.8 replies per tweet
19.8 retweets per tweet

Telegram channel - 750 subscribers

LinkedIn - 6.800 subscribers
LinkedIn doesn’t have any posts, so it’s impossible to provide the accurate ER

After the attack, the project’s initial announcement referred to it as “advanced”, however reentrancy vulnerabilities are nothing new.

The price of $GRIM fell 80% after the attack.

Charge DeFi lost 1849 $CHARGE to the same attack vector just hours before…

Was this a serial attacker?

The attack exploited a depositFor() function that hadn’t been protected against reentrancy.

This allowed the hacker to loop additional false deposits within the initial call, vastly increasing their share of the vault.

The Grim Finance team has an ongoing investigation tracking the movement of funds across the attacker’s accounts, and have found links to various CEXs.

Source

The attacker used flash loans to manipulate the price of the ELEPHANT token during the minting process of the project’s stablecoin TRUNK.

Example tx:
0xec317deb2f3efdc1dbf7ed5d3902cdf2c33ae512151646383a8cf8cbcd3d4577

Firstly, the attacker took flash loans of 131k WBNB and 91M BUSD, the 131,162.00 WBNB was swapped to 34.244e21 ELEPHANT.

TRUNK can be minted by depositing BUSD. During this process, the vulnerable contract first swaps BUSD to WBNB and then uses the WBNB to buy ELEPHANT, raising the price of ELEPHANT. By minting, the attacker both receives TRUNK and increases the value of the ELEPHANT from the previous step.

The attacker then swapped the ELEPHANT, originally acquired for 131k WBNB, to 164k WBNB. Additionally, the attacker redeemed the TRUNK for 37k WBNB and 67M BUSD, making for a total of ~200k WBNB and ~67M BUSD. After returning the flash loans (of 131k WBNB and 91M BUSD), this resulted in a profit of ~$4M

Source

The Revest team were informed of the “exploit at 2:24 UTC from the BLOCKS DAO development team”.

In addition to BLOCKS DAO, substantial losses were also suffered by EcoFi and RENA Finance.

By halting transfers of RVST tokens, the team thwarted the attacker’s attempt (70 secs later) to drain the RVST-ETH pool on Uniswap, avoiding a further $1.15M in losses.

The attacker’s dump of the stolen tokens had a large impact on the price of BLOCKS (initially down >95%, currently down ~80%) and ECO (down ~98%), however the RENA tokens remain untouched in the attackers address.

The root-cause of the attack was due to a reentrancy vulnerability in the ERC1155 minting contract (example tx: RENA)

The function mintAddressLock, used to create new Smart Vaults, contains two critical parameters: quantities and depositAmount.

Revest Vault invokes the mint function of FNFTHandler, to mint quantities of ERC1155(s) with the next fnftId to the recipient(s) which can later be burned in order to claim the position’s proportion of locked tokens. fnftId increments by 1 each time the function is executed.

Source