熱門話題
#
Bonk 生態迷因幣展現強韌勢頭
#
有消息稱 Pump.fun 計劃 40 億估值發幣,引發市場猜測
#
Solana 新代幣發射平臺 Boop.Fun 風頭正勁
Another hack, I've looked at recently is Vicuna Finance from March this year.
They lost $700K through LP token oracle manipulation on the Sonic chain.
The attack exploited a fundamental pricing flaw that could have been prevented with a simple assertion.
LP tokens were priced using a basic sum formula (price_token1 * amount_token1 + price_token0 * amount_token0) instead of fair pricing that accounts for the pool's constant product formula.
Attack sequence:
- Large swap from token0 to token1 artificially inflated LP token oracle price
- Deposit overvalued LP tokens as collateral
- Borrow maximum assets against inflated collateral value
- Reverse swap deflated LP price, leaving the protocol with bad debt
Price manipulation is a pattern we see over and over again, and it's a pattern that assertions protect well against.
In this example, we're experimenting with a new cheatcode that will allow for inspection of calls in the callstack, which is ideal for detecting intra tx price manipulations.
We check that a "swap" call cannot result in the price deviating more than 5% from the baseline at any time during tx execution. It's a simple, but powerful way to protect against, for example, flash loan attacks.

2.46K
熱門
排行
收藏