Slow Mist: DFX Finance was attacked with a serious vulnerability, and the attackers made more than $230,000 in profit

According to the intelligence of the SlowMist security team, on November 11, 2022, the DFX Finance project on the ETH chain was attacked, and the attacker made a profit of approximately US$231,138. The SlowMist security team shared the following in the form of a text message: 1. The attacker first called the viewDeposit function in the contract named Curve to check the deposit status in the contract, and then constructed a suitable flash loan based on the returned deposit status. Qian 2. Then continue to flash loan with the flash function of the Curve contract, because this function is not protected by re-entry lock, the attacker uses the flashCallback function in the flash loan to call back the deposit function of the contract to deposit 3. The deposit function is called externally The proportionalDeposit function of the ProportionalLiquidity contract, in which the funds borrowed in the second step will be transferred back to the Curve contract, and the deposit will be recorded for the attack contract, and the deposit certificate will be minted for the attack contract. The deposit function is used to transfer the funds back to the Curve contract, which successfully passed the balance check of the lightning loan repayment. With this, about 2,283,092,402 XIDR tokens and 99,866 USDC tokens were successfully withdrawn. The main reason for this attack is that the flash loan function of the Curve contract did not have re-entry protection, which led to the re-entry of the deposit function to transfer tokens Judging by the balance of the flash loan repayment, the attacker can successfully withdraw the money and make a profit because there is an account when the deposit is made.