iVest, a project on the Binance Smart Chain, suffered an exploit on August 12, 2024, resulting in an estimated loss of approximately $172,000 at the time of writing.

<p><strong>iVest</strong>, a project on the Binance Smart Chain, suffered an exploit on August 12, 2024, resulting in an estimated loss of approximately $172,000 at the time of writing. The incident highlights vulnerabilities in the custom transfer function of <strong>ERC20</strong> used to provide additional features such as <strong>tax</strong> and <strong>donations</strong>.</p><h2>Overview</h2><p>Attacker:</p><p><a href="https://bscscan.com/address/0x4645863205b47a0A3344684489e8c446a437D66C" rel="nofollow">https://bscscan.com/address/0x4645863205b47a0A3344684489e8c446a437D66C</a></p><p>Vulnerable Contract:</p><p><a href="https://bscscan.com/address/0x786fcf76dc44b29845f284b81f5680b6c47302c6" rel="nofollow">https://bscscan.com/address/0x786fcf76dc44b29845f284b81f5680b6c47302c6</a></p><p>Transaction attack: <a href="https://bscscan.com/tx/0x12f27e81e54684146ec50973ea94881c535887c2e2f30911b3402a55d67d121d" rel="nofollow">https://bscscan.com/tx/0x12f27e81e54684146ec50973ea94881c535887c2e2f30911b3402a55d67d121d</a></p><h2>Exploit Analysis</h2><p>The attack focused on the <strong>__MakeDonation</strong> function, which is invoked when transferring <strong>iVest</strong> tokens. This function burns or donates additional tokens from the sender in certain cases. Deducting more tokens than the sending amount from the sender causes serious issues in the swap pool because the attacker can use it to decrease the number of tokens in the pool, altering the <strong>k</strong> ratio and enabling price manipulation.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fee691e24-cad6-4bda-accb-deef6abc46d8_824x630.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/7ee078e4f72ddf1d28186f01f9dc0bbe.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>The attacker first flashloans <strong>WBNB</strong> and swaps it for <strong>iVest</strong> tokens. Then, they <strong>transfer</strong> an amount of <strong>iVest</strong> tokens to the <strong>WBNB</strong>/<strong>iVest</strong> pair and <strong>skim</strong> (transfer out tokens to force balances to match reserves) the tokens to <strong>address(0)</strong>, which triggers <strong>__MakeDonation</strong> to burn more tokens from the reserve of the pool. This is followed by performing a <strong>sync</strong> to manipulate the <strong>k</strong> ratio. The price of the <strong>iVest</strong> token is now much higher than at the beginning, allowing the attacker to swap the remaining <strong>iVest</strong> tokens back to <strong>WBNB</strong> and profit from the increased price.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F199a3735-a4da-4ef7-ad75-ad3474aaac9e_964x380.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/352cba3b602effec95f0f9583dbe1a0a.jpg" alt="" title=""></source></picture><div></div></div></a></figure></div><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd027034c-d744-4fb9-82c3-b37115589073_920x244.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/506b409d87c4a30319e607b8afc1fcc0.jpg" alt=""></source></picture><div></div></div></a></figure></div><h2>Lesson learned</h2><p>The <strong>ERC20</strong> contract is critically important because it manages all the funds within the ecosystem. Therefore, developers must exercise <strong>extreme caution</strong> when creating one. Avoid customizing the logic within the <strong>ERC20</strong> contract whenever possible. Any custom logic for the <strong>transfer</strong> function should be handled with extreme caution when performing swaps between tokens in an <strong>AMM</strong> pool.</p><p>It is strongly recommended to <strong>conduct a security audit</strong>, whether it is a simple <strong>ERC20</strong> contract with some minor changes or a complex <strong>DeFi</strong> protocol with hundreds of thousands of lines of code.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

iVest Token Vulnerability: How an Attacker Manipulated Prices Using the Donation Feature

iVest，一个位于币安智能链上的项目，在2024年8月12日遭受了一次攻击，造成了约17.2万美元的损失。

<p>币安智能链上的项目<strong>iVest</strong>于 2024 年 8 月 12 日遭受攻击，截至撰写本文时估计损失约为 172,000 美元。该事件凸显了用于提供<strong>税收</strong>和<strong>捐赠</strong>等附加功能的<strong>ERC20</strong>自定义转账功能中的漏洞。</p><h2>概述</h2><p>攻击者：</p><p> <a href="https://bscscan.com/address/0x4645863205b47a0A3344684489e8c446a437D66C" rel="nofollow">https://bscscan.com/address/0x4645863205b47a0A3344684489e8c446a437D66C</a></p><p>脆弱合约：</p><p> <a href="https://bscscan.com/address/0x786fcf76dc44b29845f284b81f5680b6c47302c6" rel="nofollow">https://bscscan.com/address/0x786fcf76dc44b29845f284b81f5680b6c47302c6</a></p><p>交易攻击： <a href="https://bscscan.com/tx/0x12f27e81e54684146ec50973ea94881c535887c2e2f30911b3402a55d67d121d" rel="nofollow">https://bscscan.com/tx/0x12f27e81e54684146ec50973ea94881c535887c2e2f30911b3402a55d67d121d</a></p><h2>漏洞分析</h2><p>攻击重点是<strong>__MakeDonation</strong>函数，该函数在转移<strong>iVest</strong>代币时被调用。在某些情况下，此函数会从发送者处销毁或捐赠额外的代币。从发送者处扣除的代币数量超过发送金额会导致交换池出现严重问题，因为攻击者可以使用它来减少池中的代币数量，改变<strong>k</strong>比率并实现价格操纵。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fee691e24-cad6-4bda-accb-deef6abc46d8_824x630.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/7ee078e4f72ddf1d28186f01f9dc0bbe.jpg" alt=""></source></picture><div></div></div></figure></div><p>攻击者首先借出<strong>WBNB</strong>并将其换成<strong>iVest</strong>代币。然后，他们将一定数量的<strong>iVest</strong>代币<strong>转移</strong>到<strong>WBNB</strong> / <strong>iVest</strong>对，并将代币<strong>撇取</strong>（转出代币以强制余额与储备匹配）到<strong>地址 (0)</strong> ，这会触发<strong>__MakeDonation</strong>从池子储备中销毁更多代币。接下来执行<strong>同步</strong>以操纵<strong>k</strong>比率。iVest<strong>代</strong>币的价格现在比开始时高得多，允许攻击者将剩余的<strong>iVest</strong>代币换回<strong>WBNB</strong>并从上涨的价格中获利。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F199a3735-a4da-4ef7-ad75-ad3474aaac9e_964x380.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/352cba3b602effec95f0f9583dbe1a0a.jpg" alt="" title=""></source></picture><div></div></div></figure></div><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd027034c-d744-4fb9-82c3-b37115589073_920x244.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/506b409d87c4a30319e607b8afc1fcc0.jpg" alt=""></source></picture><div></div></div></figure></div><h2>经验教训</h2><p><strong>ERC20</strong>合约至关重要，因为它管理着生态系统中的所有资金。因此，开发人员在创建合约时必须<strong>格外小心</strong>。尽可能避免自定义<strong>ERC20</strong>合约中的逻辑。在<strong>AMM</strong>池中执行代币之间的交换时，应格外小心地处理<strong>转移</strong>函数的任何自定义逻辑。</p><p>强烈建议<strong>进行安全审计</strong>，无论是简单的、只有一些小改动的<strong>ERC20</strong>合约，还是复杂的、有数十万行代码的<strong>DeFi</strong>协议。</p><div><div><div><p>感谢阅读 Verichains！免费订阅以接收新帖子并支持我的工作。</p></div><div><div></div><div></div></div></div></div>

iVest 代币漏洞：攻击者如何利用捐赠功能操纵价格

Memecoin的狂热与当前极低的代币发行门槛密不可分。只需要几美元甚至免费就能发币，这也导致每天上万种新代币被发行，加剧了PVP。每当一个热点出来，各种概念币都会立即出现，包括各种NEIRO币（大小写），川普概念币等等。
由此，各种诈骗，各种拉高割韭菜的情况比比皆是。
昨天晚上就出现了一个很有代表性的割韭菜项目——SHARPEI（$SHAR）。
据 Cointelegaraph 在开盘后发布的一...

从6000万美元到1百万美元，从万人追捧到万人唾骂，$SHAR 只用了7个小时

大型山寨币季从今天开始了
山寨币指标三年来首次呈现抛物线式上涨。
还记得2021年吗？那时，我的投资组合在一个月内从900美元飙升到14.5万美元。
这次，我将通过这些低调的山寨币赚得更多。
每个市场阶段都受到资金流入的影响，而资金流入遵循着所有市场中一致的周期，包括加密市场。
我们已经看到资金从比特币（$BTC）流向大市值代币，不久，这一重要的流动性转移也将波及小市值代币。
2024-2025周...

牛市来临前不容错过的百倍价值币

教AI启动一个Meme币很简单，但注入灵魂的人还得是人。