Summary The recent attack on WOOFi, a decentralized application built by WOO, has raised concerns in the decentralized finance (DeFi) space. The attacker manipulated the WOOFi swap contract, resulting in approximately $9 million in losses. This blog post delves into the details of the attack, examining the attacker's behavior and the vulnerability exploited.

<h1>Summary</h1><p>The recent attack on WOOFi, a decentralized application built by WOO, has raised concerns in the decentralized finance (DeFi) space. The attacker manipulated the WOOFi swap contract, resulting in approximately $9 million in losses. This blog post delves into the details of the attack, examining the attacker's behavior and the vulnerability exploited.</p><ul><li><p><strong>Project</strong>: WOOFi</p></li><li><p><strong>Chain</strong>: Arbitrum</p></li><li><p><strong>Attacker</strong>: 0x9961190B258897BCa7a12B8f37F415E689D281C4</p></li><li><p><strong>Tx attack</strong>: 0xe80a16678b5008d5be1484ec6e9e77dc6307632030553405863ffb38c1f94266</p></li><li><p><strong>Attacked contract</strong>: 0xeff23b4be1091b53205e35f3afcd9c7182bf3062</p></li></ul><h1>Deep Dive Understanding</h1><h2>Attacker Behavior</h2><p>Preparing stage:</p><ul><li><p>The attacker initiated the attack by obtaining funds through flash loan.</p></li><li><p>The acquired funds totaled <strong>10,504,796</strong> USDC.e and <strong>2,721,172</strong> WOO.</p></li><li><p>The attacker collateralized the <strong>7,000,000</strong> USDC.e in Slio Finance to borrow <strong>5,092,663</strong> WOO using the collateralized USDC.e.</p></li></ul><p>Price manipulation WOO token:</p><ul><li><p>Utilizing <strong>300,000</strong> USDC.e, the attacker executed multiple swap operations within WOOFi's swap function. It raised WOO price from <strong>56,884,100</strong> to <strong>60,400,479</strong>.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F9e1a21eb-85ca-46a1-b3a0-d34520dbcbdf_522x279.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/7dbcb51d613b35e3e1b793ec8b957155.jpg" alt=""></source></picture><div></div></div></a></figure></div></li><li><p>The actual attack occurred when the attacker swap back <strong>8,196,117</strong> WOO for USDC.e. This led to drop the price of WOO, reaching <strong>0.00000007</strong>, an 8.62 million times.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F4619acc6-7289-4d24-9d55-ab6d68cc98f9_1418x150.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/1d88f026eb003aa43ad42c49507aa604.jpg" alt=""></source></picture><div></div></div></a></figure></div></li></ul><p>Finally, the attacker used a small USDC.e to gain more than <strong>8,574,462</strong> WOO via swap. The attacker then repaid the initially borrowed funds, ultimately cashing out and absconding with the drained funds.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3be96e9a-901e-45b6-97bc-3c909daca13f_813x262.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/9f5ab39d8342db67c807e153e3ded4e0.jpg" alt=""></source></picture><div></div></div></a></figure></div><h2>Vulnerability Analysis</h2><p>Examination of the contract code revealed a flaw in the price data processing mechanism during the conversion of BaseToken to QuoteToken, <code>_calcBaseAmountSellQuote</code> function.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3991348a-635c-4e3e-8346-ca21c0b80486_855x379.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/b291ff87aaba95734730c91c0f18fbb0.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>The main vulnerability in model is direct calculating the amount by multiplying and dividing based on the price, so that there is no slippage in the exchange process but the price will change with the rate.</p><p>The WOOFi team promptly addressed the issue by removing the constant coefficient, as evidenced by the commit on their GitHub repository. </p><p><a href="https://github.com/woonetwork/WooPoolV2/commit/f5fe28acc77cf3801ac379db9bf99bb61b73ba17#diff-7a9aa780d58356f6410f39b13204e9a98ecbfafe3dd0a5f1b3147c402779e271" rel="nofollow">Patched Commit f5fe28...</a></p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F24e23641-2605-4cff-b3c4-ac9938b0bf79_2636x322.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/7833a2c0ed8a357f3dc270740ebdd3ed.jpg" alt=""></source></picture><div></div></div></a></figure></div><h1>Conclusion</h1><p>In conclusion, the attack on WOOFi highlights the vulnerabilities that can arise from flaws in economic model calculations within decentralized applications. The attacker's manipulation of token prices and subsequent draining of funds underscores the importance of robust security measures in DeFi projects.</p><p><a href="https://blog.verichains.io/subscribe?" rel="nofollow"><span>Subscribe now</span></a></p><p>The Verichains team regularly updates the most recent vulnerabilities discovered in projects they have assessed and those they are presently auditing, as well as information from the blockchain security community.</p>

Weekly Highlight: The WOOFi Hack Explain

摘要 最近对 WOO 构建的去中心化应用程序 WOOFi 的攻击引起了去中心化金融（DeFi）领域的担忧。攻击者操纵了 WOOFi 互换合约，导致约 900 万美元的损失。这篇博文深入研究了攻击的细节，检查了攻击者的行为和所利用的漏洞。

<h1>概括</h1><p>最近对 WOO 建构的去中心化应用程式 WOOFi 的攻击引起了去中心化金融（DeFi）领域的担忧。攻击者操纵了 WOOFi 互换合约，导致约 900 万美元的损失。这篇部落格文章深入研究了攻击的细节，检查了攻击者的行为和所利用的漏洞。</p><ul><li><p><strong>项目</strong>：WOOFi</p></li><li><p><strong>链</strong>：Arbitrum</p></li><li><p><strong>攻击者</strong>：0x9961190B258897BCa7a12B8f37F415E689D281C4</p></li><li><p> <strong>Tx攻击</strong>：0xe80a16678b5008d5be1484ec6e9e77dc6307632030553405863ffb38c1f94266</p></li><li><p><strong>被攻击合约</strong>：0xeff23b4be1091b53205e35f3afcd9c7182bf3062</p></li></ul><h1>深入理解</h1><h2>攻击者行为</h2><p>准备阶段：</p><ul><li><p>攻击者透过闪电贷获取资金发动攻击。</p></li><li><p>募集资金总额为<strong>10,504,796</strong> USDC.e 和<strong>2,721,172</strong> WOO。</p></li><li><p>攻击者在 Slio Finance 抵押了<strong>7,000,000</strong> USDC.e，使用抵押的USDC.e 借入了<strong>5,092,663</strong> WOO。</p></li></ul><p>价格操纵 WOO 代币：</p><ul><li><p>攻击者利用<strong>300,000</strong> USDC.e，在 WOOFi 的交换功能中执行了多次交换操作。将WOO价格从<strong>56,884,100</strong>上调至<strong>60,400,479</strong> 。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F9e1a21eb-85ca-46a1-b3a0-d34520dbcbdf_522x279.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/7dbcb51d613b35e3e1b793ec8b957155.jpg" alt=""></source></picture><div></div></div></figure></div></li><li><p>实际攻击发生在攻击者将<strong>8,196,117</strong> WOO 换回USDC时。这导致 WOO 的价格下跌，达到<strong>0.00000007</strong> ，跌幅为 862 万倍。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F4619acc6-7289-4d24-9d55-ab6d68cc98f9_1418x150.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/1d88f026eb003aa43ad42c49507aa604.jpg" alt=""></source></picture><div></div></div></figure></div></li></ul><p>最后，攻击者使用少量USDC.e 透过交换获得了超过<strong>8,574,462</strong> WOO。随后，攻击者偿还了最初借入的资金，最终套现并携款潜逃。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3be96e9a-901e-45b6-97bc-3c909daca13f_813x262.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/9f5ab39d8342db67c807e153e3ded4e0.jpg" alt=""></source></picture><div></div></div></figure></div><h2>漏洞分析</h2><p>合约程式码的检查发现，在将 BaseToken 转换为 QuoteToken <code>_calcBaseAmountSellQuote</code>函数期间，价格资料处理机制有缺陷。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3991348a-635c-4e3e-8346-ca21c0b80486_855x379.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/b291ff87aaba95734730c91c0f18fbb0.jpg" alt=""></source></picture><div></div></div></figure></div><p>此模型的主要漏洞是直接根据价格进行乘除计算金额，这样交换过程中不会出现滑点，但价格会随著汇率的变化而变化。</p><p> WOOFi 团队立即透过删除常数系数解决了这个问题，其 GitHub 储存库上的提交就证明了这一点。</p><p> <a href="https://github.com/woonetwork/WooPoolV2/commit/f5fe28acc77cf3801ac379db9bf99bb61b73ba17#diff-7a9aa780d58356f6410f39b13204e9a98ecbfafe3dd0a5f1b3147c402779e271" rel="nofollow">修补提交 f5fe28...</a> </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F24e23641-2605-4cff-b3c4-ac9938b0bf79_2636x322.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/7833a2c0ed8a357f3dc270740ebdd3ed.jpg" alt=""></source></picture><div></div></div></figure></div><h1>结论</h1><p>总之，对 WOOFi 的攻击凸显了去中心化应用程式中经济模型计算缺陷可能产生的漏洞。攻击者对代币价格的操纵以及随后资金的流失凸显了 DeFi 项目中强有力的安全措施的重要性。</p><p><a href="https://blog.verichains.io/subscribe?" rel="nofollow"><span>现在订阅</span></a></p><p>Verichains 团队定期更新他们已评估和目前正在审核的专案中发现的最新漏洞，以及来自区块链安全社群的资讯。</p>

每周亮点：WOOFi 黑客解释

刚进入了五月份，市场情绪就来了一次大幅降温，贪婪指数也从 67 直接降到了 43 哈哈，于是乎，这两天大饼的价格跌到了 57,000 美元左右。然后，似乎又有一些小伙伴开始慌了，那些前段时间信誓旦旦说只要大饼跌倒 5 开头就加仓的，现在也不加了，因为他们找了很多新的理由，比如把 CZ 获刑 4 个月也当成了这两天市场下跌的主要理由，认为大饼还会继续跌。如果我们按回撤幅度来看，大饼从最高的 74,0...

Followin

比特币会跌到50000美元以下吗？如何筛选出有上涨潜力的山寨币？

LayerZero Labs 已完成向社区成员进行空投分发的第一次快照。时间安排如下：

LayerZero 空投：团队在代币发布前拍摄第一张快照

我们很高兴地宣布 Zulu Network 已与 Web3 的统一层 Avail 建立策略合作伙伴关系。
Avail 是一个 Web3 基础设施层，允许模组化执行层...