How to hack SushiSwap through constant product? Brief analysis of SushiSwap being attacked for the second time

慢雾科技

2021-01-27 17:58 (UTC+8)

本文约1933字，阅读全文需要约8分钟

SushiSwap was attacked again. This time, the problem was that the transaction fee of the DIGG-WBTC transaction pair was stolen by the attacker through special means.

background

secondary title

What is SushiMaker?

secondary title

Talk about constant product

The formula of the constant product is very simple. Without calculating the handling fee, the formula of the constant product is

In other words, each exchange actually follows this formula, and the K value remains unchanged before and after the transaction. In the process of exchange, since the K value must be kept unchanged, the form of the formula will look like this

Where X represents the tokens sold, Y represents the tokens to be purchased, then the number of tokens that can be exchanged each time will look like this (the specific derivation process will not be demonstrated: D)

attack process

On November 30, 2020, SushiSwap had an attack due to the SushiMaker problem (for details, see:A brief analysis of the Sushi Swap attack incident from a small perspective), this attack is similar to the first attack, but the process is different. Compared with the old contract, in the new contract, the service fee will find a specific exchange route for the tokens in different trading pairs through the bridgeFor function during the exchange process, and then perform the exchange.

Among them, the logic of the bridgeFor function is as follows:

According to the logic of bridgeFor, it is not difficult to find that if the bridge of a specific currency has not been manually set, then the default bridge is WETH, that is to say, if the bridge is not set, the default is to exchange the handling fee into WETH. And the DIGG coin just happened not to set the corresponding bridge through setBridge.

But there is another problem here, that is, during the swap process, if the transaction pair does not exist, the exchange process will fail. In this attack, the DIGG-WETH transaction pair did not exist at the beginning, so the attacker pre-created a DIGG-WETH transaction pair, and then added a small amount of liquidity. If there is a transaction fee conversion at this time, according to the characteristics of the constant product mentioned above, due to the low liquidity of DIGG-WETH, that is, the upper limit of WETH in DIGG-WETH is very small, and the amount of transaction fees to be converted in SushiMaker is relatively small. Larger, such an exchange would result in huge slippage. The conversion process will increase the price of WETH to DIGG in the DIGG-WETH transaction pair, and all the DIGG fee income of DIGG-WETH will go to the DIGG-WETH transaction. By observing the liquidity of the DIGG-WETH trading pair, when the liquidity is the largest, there is only less than 2,800 US dollars of liquidity. This result can also be mutually verified with the derivation of the formula.

Summarize

This attack is similar to SushiSwap's first attack, which is to generate profits by manipulating the exchange price of trading pairs. But the process is different. The first attack was because the attacker created a new trading pair using the LP token itself and other tokens, and manipulated the price of this new trading pair by manipulating the initial liquidity to make a profit. This attack DIGG itself does not have a transaction pair for WETH, but the attacker created this transaction pair and manipulated the initial transaction price, resulting in a huge slippage during the exchange of fees. The attacker only needs to use a small amount of DIGG and WETH Huge profits can be obtained by providing initial liquidity.