Cellframe Network Suffers Flash Loan Attack Analysis

On June 1, 2023, at 10:07:55 (UTC+8), Cellframe Network was hacked on the Binance Smart Chain due to a token calculation issue during the liquidity migration process. The attack resulted in a profit of approximately $76,112 for the hacker.

Attack Details

The attacker first obtained 1000 BNB and 500,000 New Cell tokens through Flash Loans. Then, they exchanged all New Cell tokens for BNB, causing the amount of BNB in the pool to approach zero. Finally, the attacker exchanged 900 BNB for Old Cell tokens.

It is worth noting that the attacker added liquidity for Old Cell and BNB before carrying out the attack, obtaining the Old lp.

Attack Process

1. The attacker calls the liquidity migration function. At this time, there is almost no BNB in the new pool, and there are almost no Old Cell tokens in the old pool.

2. The migration process includes: removing old liquidity and returning the corresponding amount of tokens to users; adding new liquidity according to the ratio of the new pool.

3. Due to the almost non-existent Old Cell tokens in the old pool, the amount of BNB obtained when removing liquidity increases, while the number of Old Cell tokens decreases.

4. Users only need to add a small amount of BNB and New Cell tokens to obtain liquidity, and any excess BNB and Old Cell tokens will be returned to the user.

5. The attacker removes the liquidity from the new pool and exchanges the Old Cell tokens returned from the migration for BNB.

6. At this time, there are a large number of Old Cell tokens in the old pool but no BNB. The attacker will exchange the Old Cell tokens back into BNB to complete the profit.

7. The attacker repeatedly performs the migration operation.

Vulnerability Root

The calculation of token quantities during the liquidity migration process has issues, allowing attackers to profit by manipulating the pool ratios.

Security Recommendations

1. When migrating liquidity, one should fully consider the changes in the quantities of both tokens in the old and new pools, as well as the current token prices.

2. Avoid directly using the quantities of the two currencies in the trading pair for calculations, as this can be easily manipulated.

3. Conduct a comprehensive security audit before deploying the code to prevent potential vulnerabilities.

This event highlights once again the importance of considering various situations comprehensively when designing and implementing complex financial operations, especially when it involves sensitive operations such as liquidity migration. At the same time, it also reminds us that the importance of security audits in the blockchain ecosystem should not be overlooked.