Beosin: The decentralized exchange ElasticSwap was attacked, and the attackers made about $850,000 in profit

According to the Beosin EagleEye security risk monitoring, early warning and blocking platform monitoring of the blockchain security audit company Beosin, the decentralized exchange ElasticSwap was attacked. The conventional constant K value algorithm is used in the function of adding liquidity, but the balance of the two tokens in the current pool is directly obtained for calculation in the function of removing liquidity. The attacker first adds liquidity, and then transfers a certain amount of USDC .E is transferred to the TIC-USDC trading pool. At this time, it is calculated that the amount of USDC.E that should be transferred to the attacker has been multiplied by the number of LP tokens on the basis, which is several times, and then the attacker calls the method of removing liquidity to obtain profit.攻击tx:https://snowtrace.io/tx/0x782b2410fcc9449ead554a81f78184b6f9cca89f07ea346bc50cf11887cd9b18，攻击者获利约22454 AVAX（约290328 美元），截止目前获利资金还存放在攻击者账户（0x25fDe76A52D01c83E31d2d3D5e1d2011ff103c56），同时以太坊链上ElasticSwap 下The AMPL-USDC pool was also attacked by the same method, attacking tx: https://etherscan.io/tx/0xb36486f032a450782d5d2fac118ea90a6d3b08cac3409d949c59b43bcd6dbb8f, the attacker made a profit of about 445 ETH (about 564,000 US dollars). account (xbeadedbabed6a353c9caa4894aa7e5f883e32967), Beosin Trace will continue to monitor the stolen funds.