Beosin: DeFi lending protocol Sentiment most of the stolen funds are still at the attacker's address

According to the analysis of the Beosin EagleEye security risk monitoring, early warning and blocking platform of the blockchain security audit company Beosin, the DeFi lending agreement Sentiment that was attacked this morning has stolen assets of about 1 million US dollars, including 0.5 WBTC, 30 WETH, 53.8 10,000 USDC and 360,000 USDT. Currently, most of the stolen funds are still at the attacker’s address. The reason for its attack is the price error caused by reentry. The Beosin security team analyzed the incident: 1. The attacker first called the "joinPool" function of Balancer Vault to stake. 2. Then call "exitPool" to retrieve the pledge. During this process, Balancer Vault will send eth to the attacker to call the fallback function of the attack contract. In this function, the attacker calls the borrow function of the 0x62c5 contract, which needs to calculate the price based on the data returned by Balancer Vault.getPoolTokens(). At present, during the attacker's "exitPool" process, the total supply in the pool has decreased but the data has not been updated. The attacker uses this data error to lend more assets to achieve profit.