Paraluni attack event analysis

1 Introduction

1 Introduction

On March 13, 2022, Beijing time, KNOW Chuangyu Blockchain Security Lab monitored that the Paraluni project on BSC was attacked, and the hackers made a profit of about 1.7 million US dollars. Know that Chuangyu Blockchain Security Lab will follow up and analyze this incident in depth.

2. Analysis

2.1 Basic information

Attacker address: 0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f

Attacker contract: 0x4770b5cb9d51ecb7ad5b14f0d4f2cee8e5563645

Attack transaction hash: 0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54

Masterchef contract: 0xa386f30853a7eb7e6a25ec8389337a5c6973421d

UBT token contract (created by attacker): 0xca2ca459ec6e4f58ad88aeb7285d2e41747b9134

UGT token contract (created by attacker): 0xbc5db89ce5ab8035a71c6cd1cd0f0721ad28b508

2.2 Project Background

The Paraluni project is an anonymous project based on the Binance Smart Chain released by the Parallel Universe Foundation in Singapore. Users can pledge tokens to obtain liquidity benefits by interacting with the masterChef contract.

In order to make the attack process clearer, we divide this attack into two stages for analysis.

• text

pre-attack phase

• 1. The attacker creates and deploys two token contracts UBT and UGT. UBT: Rewrite the transferFrom function to realize the call to the deposit() function and withdrawAsset() function of MasterChef. UGT: The token contract of the ERC20 token standard 2. The attacker used flash loans to lend 156,984 BSC-USD and 157,210 BUSD from pancakeSwap. 3. Add liquidity to the corresponding ParaPair with the loaned USDT and BUSD, and get 155,935 Paraluni LP tokens into the UBT contract. The Lp tokens obtained at this time provide important support for subsequent attacks.

core attack stage

1. Call the depositByAddLiquidity function in the MasterChef contract, and the incoming parameters are _pid: 18, _token: [UGT, UBT], _amounts: [1, 1], which means adding 1 UGT and 1 UBT to pool 18 sex.

2. Then call the depositByAddLiquidityInternal function internally. The main function of this function is to call the addLiquidityInternal function to mint LP tokens, and then call the _deposit function to deposit LP tokens to the user address. However, the function does not verify whether the _tokens passed in by the user match the tokens with the pool number _pid, which allows attackers to use the malicious tokens they create and deploy to perform subsequent important operations.

3. depositByAddLiquidityInternal calls the addLiquidityInternal function internally, which calculates the amount of deposit required by the change of LP token balance in the contract.

4. When the addLiquidityInternal function is called to paraRouter.addLiquidity, the transferFrom function in the UBT token contract deployed by the attacker in the pre-attack phase will be called to complete the liquidity addition operation.

However, after the malicious contract rewrites transferFrom, it will call the deposit() function of MasterChef to transfer the LP tokens obtained in the third step of the pre-attack stage to masterChef. At this time, the LP balance in masterChef has changed, and then it will call the _deposit function to deposit LP tokens to the user's address, and the first LP tokens are obtained at this time.

Then, when transferFrom of the malicious contract calls deposit(), it will also call the _deposit function to deposit LP tokens to the user address, which is equivalent to obtaining two LP tokens.

5. The attacker calls the withdrawAsset function in the UBT contract and uses the attack contract to call the withdraw function in the Mastechef contract to extract two identical LPs into the attack contract;

6. Finally, remove the liquidity to obtain 310,000 BSC-USD and 310,000 BUSD, and then return the flash loan to complete the attack.

3. Vulnerability Core

This attack is mainly due to the fact that the depositByAddLiquidity function in the MasterCheif contract did not verify whether the _tokens passed in by the user are consistent with the tokens whose pool number is _pid, and the external call did not consider the re-entry problem and added a re-entry lock. As a result, attackers can pass in external malicious token contracts for reentrancy attacks.

4. Summary