[BlockSec DeFi 攻击分析系列之二] 倾囊相送:Sushiswap 手续费被盗_USH:Nothing Token

去中心化金融(DeFi)作为区块链生态当红项目形态,其安全尤为重要。从去年至今,发生了几十起安全事件

BlockSec作为长期关注DeFi安全的研究团队(https://blocksecteam

_toWETH函数:

function_toWETH(addresstoken)internalreturns(uint256){??//对于SUSHI,直接Sushimaker全部SUSHI转给Bar??if(token==sushi){????uintamount=IERC20(token)

看出什么亮点了吗?

SushiMaker里的转账逻辑都是:transfer(balanceOf(this))

我们可以分两个阶段来看convert的调用过程:第一个阶段:在?convert函数中SushiMaker拥有的是?SLP,它通过burnbalanceOf(this)实现将全部SLP换成两个底层代币第二个阶段:SushiMaker获得了burn来的底层代币,再拿burn得到的token去不同的交易池换wETH

你发现哪里有问题了吗?我们来看第二阶段的代码_toWETH:注意兑换的逻辑为:

uintamount=IERC20(token).balanceOf(address(this));

所以这个balanceOf(address(this))真的只有在第一阶段burn来的底层代币吗?Nononono~想一想,如果这里的token并不是底层代币,而是一个SLP,会发生什么?

IERC20(SLP).balanceOf(address(this))是SushiMaker拥有的所有SLP,既包含刚刚burn出来的,也包含原本SushiMaker就有的

如果底层代币是SLP,那第一阶段burn的是什么?答案是?SLP的SLP!

还记得吗?攻击者的目标是将SushiMaker诱到其创建的恶意交易池中交易,这个SLP1/WETH池不恰好是攻击者创建的,当攻击者调用convert(SLP1,wETH)时,SushiMaker由于上面这一漏洞会将其全部的SLP1都到SLP1/WETH池中换取WETH——正中下怀

SLP/WETH池一般都是不存在的,或是深度很浅的。攻击者其实也可以通过建立SLP1/SLP2来实现攻击,但是这样的话,还需要单独为SLP1、SLP2建立SLP1/WETH,SLP2/WETH,不如直接一步到位

1.4RealWorld

管你看没看懂,继续看就完了下面我们来看看攻击者在真实世界中到底做了什么吧?

攻击者地址:0x1925e832C22522E0d9947eE4677120b2f28E4cD4(https://etherscan.io/address/0x1925e832c22522e0d9947ee4677120b2f28e4cd4)

一组攻击包括很多笔交易,这里以对?MKR/WETH?池的攻击为例:SwapExactETHforTokens:?0xa8c4edd85727dApprove:0xf1fdd4cf4d8aaAddLiquidityETH:0x7340edca1a17fApprove:0x41a33f0c91b7cAddLiquidityETH:0x896f412f15a7aTransfer:0x0e8a76bf7295dConvert:0x4947b4f075f8eSwapExactETHForTokens:0x5f37bb3b97341RemoteLiquidityETH:0xdff10159275e0SwapExactTokensForETH:0xb8889bbdeb478

攻击者的一个完整的攻击周期:

序章:攻击准备

Step1:通过swapExactETHForTokens用一些ETH换取MKR,作为攻击的启动资金

Step2:将刚刚换到的MKR和ETH一起,向Sushi的MKR/wETH交易池中添加流动性,获得该池的SLP(MKR/wETH)

Step3:将刚刚换到的SLP和ETH一起,向Sushi的SLP/wETH交易池中添加流动性,获得新池的SLP(SLP/wETH)(后简称SLP')

Step4:将新生成的SLP'转给SushiMaker

这步有什么意义呢?因为攻击者后续会调用convert(SLP,wETH),将SushiMaker.sol合约中存放的SLP'燃烧掉,换出SLP,wETH。如果SushiMaker.sol中没有SLP'就没法进行下去了

但是,实际复现过程中,我发现有没有这步其实都影响不大。因为上一步addLiquidity(SLP,wETH)是,一方面会mint出SLP'给攻击者,另一方面还会mint出一些SLP'给SushiMaker.sol,所以SushiMaker.sol中其实还是有一点SLP'的→现在攻击者手里有SLP',其实他有两个不同的决策:

以太坊升级以来已有超336万枚ETH新存入质押 APR为8.64%:金色财经报道,Token.Unlock数据显示,自以太坊上海升级完成以来,已有约266万枚ETH解除质押,约336万枚ETH新存入质押,净质押余额约70.4万枚ETH。即以太坊上海升级完成以来的ETH新存入质押数已超过解除质押数。此外,当前约枚3.29万ETH处于待提款状态,质押APR为8.64%。[2023/5/14 15:02:20]

1.将SLP'转给SushiMaker,这样SushiMaker可以换出更多的SLP和wETH,下一步回到这个交易池将自己所有的SLP换成wETH2.不转SLP'给SushiMaker,因为之前创建SLP/wETH这个池的时候会mint一点点SLP'给SushiMaker,所以还是可以通过调用convert将SushiMaker存的SLP都换成wETH

第一种方式中,使SushiMaker拥有的SLP'更多,会换出更多的SLP和wETH,使得池中的滑点更大,SushiMaker能亏的SLP就更多,但是如果SushiMaker中本身存的SLP就不多,SLP/wETH深度也不大时,其实结果差不太多,都是几乎将SushiMaker搬空。总而言之,还是第一种方式更优,可以看出攻击者其实是有精心考虑过的

高潮:攻击SushiMaker

Step5:调用convert(SLP,wETH),这一步中,SushiMaker会先将SLP'burn掉,换成SLP和wETH,再将自己所有的SLP都转成wETH,问题在于?SLP/wETH这个池是由攻击者创建的,池中的深度非常小,滑点极高,SushiMaker通过?swap将SLP换成wETH这步会血亏

尾声:获利

Step6:上一步中,SushiMaker在SLP/wETH这个池中血亏了大量的SLP,池中wETH巨值钱,此时攻击者只需要调用swap用一点点wETH就可以几乎将整个池子搬空

0x2.附录

2.1本次事件相关的攻击交易:[??{????"YFI/WETH":{??????"0x18be4ac177c5ada3522e3cafd6c40d750d4288a3a7b22e140521124074fed2ae":"SwapExactETHForTokens",??????"0xc8653ef0c4658acf3d44059babea07c62578769cac10176e61310f7af04e1597":"Approve",??????"0x18ed3e5efeec3e475501786541a4f7602340e5aa6bc6cbf24b9c9aa1062449ac":"AddLiquidityETH",??????"0x42d553b614d0a64ea2cfe95bf2a99d337c07f1b53ac4d7987966fc39817975e6":"Approve",??????"0x041463e755e91548b9d6dd1e61519b08f101ff96a44df969b33ee57996619a88":"AddLiquidityETH",??????"0x8a2d7926e50123459b7814c0e19b5ac59f7ce221cb5fa82f79d2c0c37ef7ef1f":"Transfer",??????"0xaa001ac10841c784954b0028192f0ea232bf84e390b964af98f1c49074ec4beb":"Convert",??????"0x08bbbeaf7cbd2649738812cf720042eb7ebe1411be2f7cf3ede41411dcbf8bc0":"SwapExactETHForTokens",??????"0x3952f24ef1e5dce37463edcf0f3902316131fb823d79946b96f2a2397a9cd25d":"RemoveLiquidityETH",??????"0x47c200fefd8c007d972b65b97dadf429c3e6e91359b7b49aaa66ee0fc4a555f4":"SwapExactTokensForETH"????},????"profit":"0.2558139ether"??},??{????"USDT/WETH":{??????"0x123ec6c44fa3baa70c66f583f8ee6bc6b6d2b4d39a1119ab8490d2c1120d4647":"Convert",??????"0x08bbbeaf7cbd2649738812cf720042eb7ebe1411be2f7cf3ede41411dcbf8bc0":"SwapExactETHForTokens",??????"0x42973ea279d0bda4222e4689709f86bdb12117dce14420f84f3e9cc6fd42ede2":"RemoteLiquidityETH",??????"0x30eab0a184f9a1ed6cee309754bb6536bd443fea567776a72b72f3ab911e0113":"SwapExactTokensForETH"????},????"profit":"0.1835604ether"??},??{????"MKR/WETH":{??????"0xa8c4edd85727d3d25401f0cbca1136982edb833f77ff0a93178b222063eb57a4":"SwapExactETHforTokens",??????"0xf1fdd4cf4d8aa073ff01876333cfeadeab2b87423664d1daa4cf36ad5e415587":"Approve",??????"0x7340edca1a17fc9e5a6587d6a89c0ed01c5d1f1d20cb19738ab993f6ef7b8b4d":"AddLiquidityETH",??????"0x41a33f0c91b7cd17edf888356dfb110d7744f593e432b54ec2f21aae19076aa0":"Approve",??????"0x896f412f15a7abb959c3c43b8cd9206720fc37f4eabeae336ba101670003e9db":"AddLiquidityETH",??????"0x0e8a76bf7295d9316704fde7f953eced612daa9ca7a70322248eeb8a7f508656":"Transfer",??????"0x4947b4f075f8e9f89f6364158b3d05a92cd72b7920c44c2150a0d12ba009a7a0":"Convert",??????"0x5f37bb3b9734175b605f6e02700c4b710e5e01622f30d822bcca227d91363d77":"SwapExactETHForTokens",??????"0xdff10159275e064dad2c7c79585d1f3c4fd60b73d843715e0cff1a2292730e99":"RemoteLiquidityETH",??????"0xb8889bbdeb478809c3781ccb1c8a16f9fa90b6844d180818b6e73a16963a5ddc":"SwapExactTokensForETH"????},????"profit":"1.9761631ether"??},??{????"KP3R/WETH":{??????"0xe5a025658cd28a688442a57a9b441980feeed8f5e7892064efc68966eb4253eb":"SwapExactETHForTokens",??????"0xe77e7e9d636c2b733d226693d95d06005ae2b5aa8532957240310225aa73e051":"Approve",??????"0x5ce8451f9f39f2d32ffbd943d38723a8da6fff59ece8f62caa84c4c2a311ede3":"AddLiquidityETH",??????"0x171b741bb7cdcafebdbed1c503eb33babc70c2e2e45b2b55330df3bc6d5c9eda":"Approve",??????"0x0ad658ebab282a26d67da0a97083a41c83d0eb1ab6d19a4adb3676b57fc3851c":"AddLiquidityETH",??????"0x676dd29fade2b93e5ca4b0da9d2b5e4ede86f69d26a6201440e359892360b096":"Transfer",??????"0x3b37a792edbb785b223a2b4f0971834083acd52503e54d00989a365bbc533627":"Convert",??????"0x4df5506fdc7616ff65b4ae3b93360e180c7b6f5e976914c4af04648ad6559817":"SwapExactETHForTokens",??????"0x07e56eaa7935fb341654ac20223b0d32fab006b3f34e372aecf6bce05c3f903f":"RemoveLiquidityETH",??????"0x8f4d9d676e9a12d07dcd0c8225e207df48f8cb575cdaa6d81c4b7124c3500510":"Approve",??????"0xac3c837c249fb68ceebd896a72e1e4e8cf355caf3f5fcd0bdc7df7c101ea0596":"SwapExactTokensForETH"????},????"profit":"1.8226875ether"??},??{????"YFI/WETH":{??????"0x1b0eb70bc4d2407745df416acf6e2c312d25ee63c7e8e1291545d66e23fbf704":"PreAttack",??????"0x8f6caabd4ecfad30793db76f60a7e28832a18e2bcf006c0ee3652063c7386778":"Convert",??????"0xe6d28052b55ab520a211daebbc67ee3aece6ae356044e9352fc82910214a038a":"Swap"????},????"profit":"-0.031382ether"??},??{????"AXS/WETH":{??????"0x375f5befeb1af976ebb09cf5539b3a3b9746b87153cfa96ba862deb8828970f1":"PreAttack",??????"0xed8508a18c347c3829024f7acb94056a78cc63152e2246ebd42b59cd86d0c8f9":"Convert",??????"0xd08eb264e39cd5dca8edb3684dfd36afb905aea9c47a43110b6c5c45bdb2f7d1":"Swap"????},????"profit":"1.349482ether"??},??{????"CRD/WETH":{??????"0xc6c86de784359a3813b31b4be5806a23f82fdd8d5cd9bd3a7379d33a413eb920":"PreAttack",??????"0x7d1b36019fb287867419dffb281b5ad73b37d8dc21abca47f7b618875842ef0a":"Convert",??????"0x8c14595b205cd04d1e5062a3efe47d3e4dae946eabe744e2d8350d6ba951495a":"Swap"????},????"profit":"1.325357ether"??},??{????"USDC/WETH":"Failed"??},??{????"COVER/WETH":"Failed"??},??{????"YAX/WETH":{??????"0x063bc5df97c0ec87d6c309b54fbc4e3ed13b22f5a115fb1170015e4e9d23cd3d":"PreAttack",??????"0x9537551d0db7ed6ae372c050c73cae1272f4d7e7847ea908d6e4d440809a871f":"Convert",??????"0x9f6bdf1c9065f5f5e5c71f32058093b7ac06e140c3a33db2f21cc8a5ff8a5d21":"SwapExactETHforTokens",??????"0x9281c35277ea6594924600d70b73077a4307973c540edb5b4ed534c7e25f2423":"Approve",??????"0xe2f682d8b4801061d504025f11b3032648a3b94019396f7b12749b162f8404cf":"RemoteLiquidityETH",??????"0xf6ea6c9eb92ca9aed70e8b4b03a6e5565a3a13df71a0aa527fa556077de553bc":"Approve",??????"0xbf19c9a6a4d879467519299100b4f56c4e86369382ba87d90bebf6c1b1893c14":"SwapExactTokensForETH"????},????"profit":"1.153749ether"??},??{????"SEEN/WETH":{??????"0xc6b39015ab0a32762fb23108e9705cb30d171374c7f9d4b9cf30e640f43d4884":"PreAttack",??????"0x3c14c48007147f78ae3c3ac5d56f74413ebc468c6e09f7eb1098c19b9b546185":"Convert",??????"0x8681b43b4814bb54f49650b19d42133c933bcdbc65dfcd36a6cadf7ef916391c":"Swap"????},????"profit":"1.0703319ether"??},??{????"AAVE/WETH":{??????"0x97c06394d2b9f34606946b438b4fb26ab41f379f8612831c2ec4ed6daac6b4e3":"PreAttack",??????"0x7eb4eada4f0700e8a2e8b94d4e4a1879e66ccb36285968500e370420210dde6d":"Convert",??????"0x40ae49cdb3e9fa61c3309bf35d08ec99494d4a6aa2815791aed1ca654a04d211":"Swap"????},????"profit":"0.987368ether"??},??{????"REVV/WETH":{??????"0x59b5e394caf35f5bbe603b42044707cbb20712d765c260da4434fde0fd3c0e15":"PreAttack",??????"0x45660abd04d88f0dae0524b40182d11cb57710316e58ac14413909a9aaf44869":"Convert",??????"0xcd8749d61d8e96da48de8bd641280f2ce8d93aa5e1e44c9144d322d8b01b1c81":"Swap"????},????"profit":"0.888306ether"??},??{????"SNX/WETH":{??????"0x7eea5790e31176d45b944c0f2624c30a755650b1a353e052191e36d23db2abbc":"PreAttack",??????"0x1518424118b519af43657d5de42311f5b5174aab941ff1b7bfe14b0ef5d0874a":"Convert",??????"0x04cd83c93cf8f37fbafb7d05d5f34cb23bcef8871b2744efad517e6aab38395c":"Swap"????},????"profit":"0.908345ether"??},??{????"OUSD/WETH":{??????"0xc4c196e2383e472edf7dee0c93830f20b3314490d9145dfeac936249688a4cd8":"SwapExactETHForTokens",??????"0x975e65569e52644fe7b029ce28fef2c3f07dcb818ea9c9d4b7235ab7c4e11c67":"Approve",??????"0x8c569e7eaa6d7dfc57d5115e628a2b8fc2628837d4e73d6ca85125f639e4f0d0":"AddLiquidityETH",??????"0x0f2ed674f497069878c585297812f036a6dd50060e0685e275092320a3797db0":"Approve",??????"0x483eb12c36b997e9fcb26210e116400f13702db4887b0f4cc3e04fdb8d40c04b":"AddLiquidityETH",??????"0xc18eb762dc3fe84afdc7d2642f380c7f56c5ac18eb9a50103766ba0caa5a6bdf":"Transfer",??????"0x45fd39eef68076c052908c7f8a214cac1cad073f2b5ccf0b919e95670bc801d5":"Convert",??????"0x32beea84a5b4916cd7107adbb8f609071547e78751c360ceee9bff455d3e7660":"SwapExactETHForTokens",??????"0x2eb1802c7771695e6dc0835ed2a0e4d029345f35f1d465b8f15ccae11824da2a":"RemoteLiquidityETH",??????"0x2be981eb82e7577ce43c91718e734cc83e7dd4b384095ea18d62540e53b391bc":"SwapExactTokensForETH",??????"0x584c6f03a2029bc1b262f31016d87156af3c0c773ebad44f6a2b1e63d623ba5d":"SwapExactTokensForETH"????},????"profit":"0.4029899ether"??},??{????"CRV/WETH":{??????"0xa7b8e476e15ff576878efee81bf200abeec1491941c5507ca846b51cd685d01e":"PreAttack",??????"0x19ee64733e4edb44e22086814e7493f30d5bb66582e5963b0db9ea8d05a5bd73":"Convert",??????"0xe959e2079d1366893cce39212194fd387a0c4594f423c07b9af0d4fa7c2c062c":"Swap"????},????"profit":"0.698111ether"??},??{????"LINK/WETH":{??????"0x62b3ae66524c68ddabd255066807cd7b7f7304e4e8b2da72b9a5e4d8352d35b9":"PreAttack",??????"0xb0f7512a12afabb56b3d69cef4df83add82c81338dc92e059d8ba130ef777a1e":"Convert",??????"0x54570d6f723c3b9f9c6c9e5f7c0357ba50c847b87f17ef5bb517416dcc7f47c3":"Swap"????},????"profit":"0.6134929ether"??},??{????"RSR/WETH":{??????"0xa69b5290fe5dd5580e0c738baa47000cf51ed77cc06b8b54a244c7509f8002ad":"PreAttack",??????"0x87a639847c58b6704f28407be39e3ec64b01f005b47753b1a99faf776ea11780":"Convert",??????"0xa458915881d79debafe5f465843931e572321d35bc98ec25db9ecb9f6a3ea6fd":"Swap"????},????"profit":"0.589048ether"??},??{????"CORE/WETH":{??????"0xa01fd6fcfee90a7a2b0a180e7271b9429e9f23cf502ba7966932e5012c1bc9b7":"PreAttack",??????"0x05af95d603cba12d9ca14ce307a973c8875cdcb2e70b07b295440cd2940ea953":"Convert",??????"0x9bb8b7ca5b41c55a8efcdcd49fdec16747ccee0bf33df8e8f4d62eb116142b21":"Swap"????},????"profit":"0.236909ether"??},??{????"zLOT/WETH":{??????"0x0bb5d792a1d1ea598e45997d5dedb4fcf6acafab47afdb45892417cd128cf37f":"PreAttack",??????"0x2550eb33adbe7cfb68cce685363ad2cab90860e5e8a8ed87de1f0a6321e24cf8":"Convert",??????"0x514bd13f68c8afc1f86ea3e74ca5f51724c2736fa327144b7b6aaf7228bd9124":"Swap"????},????"profit":"0.516633ether"??},??{????"USDC/WETH":{??????"0x98b24059e21c3bdbf7de835f8f30daacaac7a00ba2e9cfdff7e0540b172828aa":"PreAttack",??????"0x29fd17d8060f94cd43b45718d0f36df727a27ff4ce67b3ce5a65d6d40ff2d99a":"Convert",??????"0x24b03cbacf310b5efd2500c3aa8499a356a5ea835426a33d929a38ceef6ea83d":"Swap"????},????"profit":"0.688682ether"??},??{????"sUSD/WETH":{??????"0x8014c37ff678124d5fcf652547264769aa125bba933aadd4a81a4f6115d71ff2":"PreAttack",??????"0xc55509dbd81f4da525a540cdbd319d1ffacd2aab2dd3f07abd51cfa2528f28fb":"Convert",??????"0xc0867b786399a23804f60bb2e974ee5f214a44d418ba5d7a0e51496f9d5f8ff8":"Swap"????},????"profit":"0.4547969ether"??},??{????"AKRO/WETH":{??????"0xc38c30660b9c06e9cecc77c9ff0019020eb9c6fa20887dc15b354ed1a50fec26":"PreAttack",??????"0x03b9eb788861e5442c3739738cfa848c73f20871e110c6587609169136c3e772":"Convert",??????"0x88d3a3e31df87329e87fbfc21b9648907365c1e2d5a7a236eae5655c1ba3ad41":"Swap"????},????"profit":"0.43971ether"??},??{????"DAI/WETH":{??????"0x6964f68672edb916ae170254ee48c537cbb64ca0584651d21fd575550559354f":"PreAttack",??????"0x61856228835bfd97dc6b9d7674aaabb577b74fa7d7ff7b7f45454a8d521ff533":"Convert",??????"0x053ebfe8aedd5975137cfa9bf7d7329a2d6413f6d6e364b252f4386222957eed":"Swap"????},????"profit":"0.694006ether"??},??{????"YFI/WETH":{??????"0xf28c246bf1ce25da1811c7c0eb6fefb8587fa2cdafc84cec4e709600429e6e3f":"PreAttack",??????"0xc75a8ca881d4da75774f51006651c9946311d40145ce69d07aee3a85627153d6":"Convert",??????"0x332c7eff23c9022fe6578550a079034cd3356d9f66507d2ec38462169a4b282c":"Swap"????},????"profit":"0.672139ether"??},??{????"UBXT/WETH":{??????"0x635c79a8dca89a3aa95f545e2243a735906c4ff221cfbc160396c150d58ea036":"PreAttack",??????"0x3ffcfc9985622ad7cf0fdc2eb582ad7ce8bf9e9295fd7a4de44354fdd71a688a":"Convert",??????"0x7c6af5ca27ceb04aad514ddcaee8afc6dd4eb79d0816e24b007e7db205e93ce3":"Swap"????},????"profit":"1.1470659"??},??{????"0xMaki":"Iseeu."??},??{????"WBTC/WETH":{??????"0xa195c9c23a56ca5fa747677c04a2d5a8c513bdfd141e45c20a8c4e091ca73883":"PreAttack",??????"0x136b1d2bf6c51a6ed1fc3f1da7a2783e3835fa78c9149c1c6d2b21e9aad8b05b":"Convert",??????"0x43cde98b0be5932b8dbf709eebd0cbb4738599c9a4f0795ddb52d7d31f293cf4":"Swap"????},????"profit":"2.575794ether"??},??{????"USDC/WETH":{??????"0xfc8196231bfb22ae6fcc9ceb04f9e5e3d647fc9e023870020048be93958218a5":"PreAttack",??????"0xe43fe2eb54c2eefba519a7ff9cf27f84e743961268dfdf9477a47cd2ea467642":"Convert",??????"0x4b0b3b51150b3a270d10f3388ccf12a196a2cada4203e3a2c39af88d5dc04958":"Swap"????},????"profit":"1.157208ether"??},??{????"LINK/WETH":{??????"0x95eea1cedccffc405d0cb9743360712b69a295a66fe0649b5ab1b067869f05fa":"PreAttack",??????"0xf259718ee2f81b543bbfbe2f236cd4235651f8365ec8944741a3c7f3242f06b9":"Convert",??????"0x525929006fc3f089d67b6596f53c5ebe6b82de1f8d3cdeb397f1f55ff4937c47":"Swap"????},????"profit":"0.7395449ether"??}

A股收盘:深证区块链50指数下跌1.54%:金色财经消息,A股收盘,上证指数报3567.44点,收盘下跌0.73%,深证成指报14223.35点,收盘下跌1.27%,深证区块链50指数报3740.07点,收盘下跌1.54%。区块链板块收盘下跌1.38%,数字货币板块收盘下跌3.59%。[2022/1/11 8:40:56]

后续攻击者又尝试攻击Sushiswap的其他相关仿盘项目,如LuaSwap:

https://etherscan.io/tx/0xeacfed6fb18563c18b9af5cb0d3a5b13e97cf02026ef9a4cb625cc33580d02a7

但可能获利不多,只成功几笔就不了了之了

2.2本次事件后续结果:

在**#11351530**块,Sushi的管理员向攻击者喊话:

可以看到,好像有些延迟,攻击者的攻击依然持续了一段时间:

最后一条Convert中:

SushiMaker地址从0x6684977bBED67变成了0x280ac711bb99d:

Old:0x6684977bBED67e101BB80Fc07fCcfba655c0a64F??functionconvert(addresstoken0,addresstoken1)public{????//Atleastwetrytomakefront-runninghardertodo.????//限制只能EOA来调用该函数????require(msg.sender==tx.origin,"donotconvertfromcontract");????//获取相应SLPtoken合约的地址????IUniswapV2Pairpair=IUniswapV2Pair(factory.getPair(token0,token1));????//将SushiMaker中存有的全部SLP,转给交易池????pair.transfer(address(pair),pair.balanceOf(address(this)));????//Burn掉这些SLP换成两种token????pair.burn(address(this));????//分别将两种token找到相应的和wETH的交易对,全部转换为wETH????uint256wethAmount=_toWETH(token0)_toWETH(token1);????//将转换的到的全部wETH找wETH/SUSHI交易对换成SUSHI_toSUSHI(wethAmount);??}??function_toETH(addresstoken){????...????uintamountIn=IERC20(token).balanceOf(address(this));??}New:0x280ac711bb99dE7C73FB70fb6DE29846D5e4207F??functionconvert(addresstoken0,addresstoken1)public{????//Atleastwetrytomakefront-runninghardertodo.????require(msg.sender==tx.origin,"donotconvertfromcontract");????IUniswapV2Pairpair=IUniswapV2Pair(factory.getPair(token0,token1));????pair.transfer(address(pair),pair.balanceOf(address(this)));????(uintamount0,uintamount1)=pair.burn(address(this));????uint256wethAmount=_toWETH(token0,amount0)_toWETH(token1,amount1);_toSUSHI(wethAmount);??}??function_toETH(addresstoken,uintamountIn){????...??}

可以看到区别在于:代码第26行_toWETH限制了amount,这样修改以后就不会将SushiMaker中存的全部SLP都去池中换成wETH,而只是换取burn出的一部分

但是这样问题就解决了吗?其实还没有,时隔两个月,同样的地方,Sushiswap又中了见:amenda:SushiSwap攻击事件(2021年1月27号)分析(https://zhuanlan.zhihu.com/p/372058217)

0x3.参考

以小博大,简述SushiSwap攻击事件始末:https://www.chainnews.com/zh-hant/articles/726256718885.htm

Astokenpricerisesandreputationmends,Sushiswapfoilsmidnightexploit:?https://cointelegraph.com/news/as-token-price-rises-and-reputation-mends-sushiswap-foils-midnight-exploit

DeFi 概念板块今日平均涨幅为7.11%:金色财经行情显示,DeFi 概念板块今日平均涨幅为7.11%。47个币种中44个上涨,3个下跌,其中领涨币种为:MLN(+38.23%)、IDEX(+19.60%)、SWFTC(+18.89%)。领跌币种为:LBA(-3.86%)、AKRO(-3.36%)、DMG(-1.96%)。[2021/3/30 19:28:09]

AnevolutionofUniswapwithSUSHItokenomics:https://sushichef.medium.com/the-sushiswap-project-dd6eb80c6ba2

一文看懂Uniswap和Sushiswap:https://zhuanlan.zhihu.com/p/226085593

sokdecentralizedexchanges(dex)withautomatedmarketmaker(amm)protocols:?https://arxiv.org/abs/2103.12732

AttackingtheDeFiEcosystemwithFlashLoansforFunandProfit:?https://arxiv.org/abs/2003.03810

https://www.blocksecteam.com/

动态 | OGN今日正式上线BiKi 涨幅达200%:据官方公告,OGN(Origin Protocol)在BiKi 平台现已开放充值业务,并已开放OGN/USDT交易对,OGN当前涨幅200%,现报价0.3USDT。

据介绍,Origin起源的目标是实现真正的点对点商务,买卖双方可以直接交易,无需中介。目前,用户可以在Origin的旗舰商店及其合作伙伴应用上买卖商品和服务。市场运营商也可以在Origin的开源平台上开发创建自己的应用。Origin代币(OGN)是起源协议的一个重要组成部分,作为一种激励机制保证网络的健康和发展,让每一个使用者,贡献者成为利益的分享者。[2020/1/8]

行情丨HT在15分钟内涨幅超过3.00%:据火币全球站数据显示,HT/BTC在15分钟内出现剧烈波动,涨超3.00%,达到3.45%。当前报价为 2.36 美元,行情波动较大,请注意风险控制。[2019/5/12]

郑重声明: 本文版权归原作者所有, 转载文章仅为传播更多信息之目的, 如作者信息标记有误, 请第一时间联系我们修改或删除, 多谢。

金宝趣谈

[0:15ms0-5:285ms