Decoding Palmswap’s $900k Exploit

Decoding Palmswap’s $900k Exploit

Decoding Palmswap’s $900k Exploit

Decoding Palmswap’s $900k Exploit

Decoding Palmswap’s $900k Exploit

Read Time: 4 minutes

Summary:

On the 25th of July 2023, the Palmswap on the Binance Smart Chain was attacked. The attack was made possible by a Price Manipulation vulnerability. And around $900k was stolen by the exploiter from the exploit.

About Project:

Palmswap is a decentralized leverage trading platform. To learn more about them, check out their documentation.


Vulnerability Analysis & Impact:

On-Chain Details:

Attacker Address:  0xF84efA8a9F7E68855CF17EAaC9c2f97A9d131366

Victim Contract:  0x55252A6D50BFAd0E5F1009541284c783686F7f25

Attack Transaction: 0x62dba55054fa628845fecded658ff5b1ec1c5823f1a5e0118601aa455a30eac9


The Root Cause:

  • The root cause of the exploit was the mishandling of calculations when adding or removing liquidity from the pool. It was present in the exchange rate between USDP(Palm Usd) and PLP(Palm Lp).
  • The process of calculation of PLP price when we remove liquidity is handled by getAum() function.
  • Now take a look at buyUSDP(). As you can see, the highlighted functions are called to increase the price of PLP when buying USDP.
  • Increase in the value of PoolAmount while buying USDP affects getAum() function since it is dependent on PoolAmount for calculation.
  • This allowed the hacker to remove liquidity on a higher exchange rate used when adding liquidity
  • Buying Exchange Rate – 1:1 
  • Selling Exchange Rate – 1:1.9

Attack Process:

  • First, the attacker took a FlashLoan of 3 Million. 
  • Purchase PLP token worth 1 Million by calling purchasePlp() function.
  • This purchasePlp() function will call 2 functions. 
  • _mintAndStakePlp() 
    • This function will add liquidity in the pool 
    • buy USDP 
    • and mint plp in 1:1 ratio.
  • vester.deposit
    • This function will deposit the staking amount.
  • Now the attacker used the remaining 2 Million to buy USDP by calling buyUSDP() function. This will inflate the exchange rate. 
  • Now the attacker unstaked the previously staked amount by calling unstakeAndRedeemPlp() function. This will send USDP to the attacker’s address at an inflated price.
  • Now the attacker called sellUSDP()  function to sell all the staked amount. This includes
    • 2 Million USDP
    • USDP that the attacker received after inflating the price from the previous step
  • Finally, the attacker repaid the FlashLoan of 3 million and gets the remaining $900k profit.

Flow of Funds:

Here is the fund flow during and after the exploit. You can see more details here.

Attacker’s Wallets:

Currently, all the funds reside in this address – 0x0fe7457f5909778b15d8e46768678abbf0c98329

Here is a snippet of the wallet address


After the Exploit

  • The Project acknowledged the hack via their Twitter.

Incident Timelines

Jul-24-2023 (05:23:38 PM +UTC) – A suspicious transaction was spotted on PalmSwap’s Contracts.

Jul-24-2023 (06:33:31 PM +UTC) – Exploiter was successfully able to steal $900k BUsd.

Jul-24-2023 (06:33:31 PM +UTC) – The exploiter transferred the funds to this address.


How could they have prevented the Exploit?

  • When dealing with business logic where processes like staking and unstaking are happening, it is crucial to write comprehensive Test Cases.
  • It is recommended to make sure to check that all the invariants hold true or not before deployment. Implement fuzzing wherever necessary.

The Imperative Need for Web3 Security

As a Web3 security firm QuillAudits, we embrace the essence of decentralization by offering transparency, and we want that spirit to shine through in our services too.

2,358 Views

Blockchain for dog nose wrinkles' Ponzi makes off ~$127M🐶

Project promised up to 150% returns on investment in 100 days, raising about 166.4 billion South Korean won — or about $127 million — from 22,000 people.

Latest blogs for this week

Understanding Fuzzing and Fuzz Testing: A Vital Tool in Web3 Security

Read Time: 5 minutes When it comes to smart contracts, ensuring the robustness and security of code is paramount. Many techniques are employed to safeguard these contracts against vulnerabilities
Read More

How EigenLayer’s Restaking Enhances Security and Rewards in DeFi

Read Time: 7 minutes Decentralized finance (DeFi) relies on Ethereum staking to secure the blockchain and maintain consensus. Restaking allows liquid staking tokens to be staked with validators in
Read More

ERC 404 Standard: Everything You Need to Know

Read Time: 7 minutes Introduction Ethereum has significantly shaped the crypto world with its introduction of smart contracts and decentralized applications (DApps). This has led to innovative developments in
Read More

DNS Attacks:  Cascading Effects and Mitigation Strategies

Read Time: 8 minutes Introduction DNS security is vital for a safe online space. DNS translates domain names to IP addresses, crucial for internet functionality. DNS ensures unique name-value
Read More

EIP-4844 Explained: The Key to Ethereum’s Scalability with Protodanksharding

Read Time: 7 minutes Introduction  Ethereum, the driving force behind dApps, has struggled with scalability. High fees and slow processing have limited its potential. They have kept it from
Read More

QuillAudits Powers Supermoon at ETH Denver!

Read Time: 4 minutes Calling all the brightest minds and leaders in the crypto world! Are you ready to build, connect, and innovate at the hottest event during ETH
Read More

Decoding the Role of Artificial Intelligence in Metaverse and Web3

Read Time: 7 minutes Introduction  Experts predict a transformative shift in global software, driven by AI and ML, marking the dawn of a new era. PwC predicts AI will
Read More

Transforming Assets: Unlocking Real-World Asset Tokenization

Read Time: 7 minutes In the blockchain, real-world assets (RWAs) are digital tokens that stand for tangible and conventional financial assets, including money, raw materials, stocks, and bonds. As
Read More
Scroll to Top

Become a Quiffiliate!
Join our mission to safeguard web3

Sounds Interesting, Right? All you have to do is:

1

Refer QuillAudits to Web3 projects for audits.

2

Earn rewards as we conclude the audits.

3

Thereby help us Secure web3 ecosystem.

Total Rewards Shared Out: $200K+