Cellframe Network Flash Loan Attack Incident Analysis

On June 1, 2023, at 10:07:55 (UTC+8), Cellframe Network was attacked by hackers on a certain smart chain due to a token quantity calculation issue during the liquidity migration process. This attack resulted in the hackers profiting approximately $76,112.

Root Cause of the Attack

The calculation issues during the liquidity migration process are the main reason for this attack.

Detailed Attack Process

1. The attacker first obtained 1,000 native tokens of a certain chain and 500,000 New Cell tokens through Flash Loans. Then, they exchanged all New Cell tokens for native tokens, causing the number of native tokens in the liquidity pool to approach zero. Finally, the attacker exchanged 900 native tokens for Old Cell tokens.

2. It is worth noting that the attacker added liquidity of Old Cell and native tokens before carrying out the attack, obtaining Old lp.

3. Next, the attacker invoked the liquidity migration function. At this point, there are almost no native tokens in the new pool, and almost no Old Cell tokens in the old pool. The migration process consists of the following steps:

   • Remove old liquidity and return the corresponding amount of tokens to the user
   • Add new liquidity according to the proportion of the new pool

   Since there are basically no Old Cell tokens in the old pool, the number of native tokens obtained when removing liquidity increases, while the number of Old Cell tokens decreases. This causes users to only need to add a small amount of native tokens and New Cell tokens to obtain liquidity, while the excess native tokens and Old Cell tokens are returned to the users.

4. Finally, the attacker removes the liquidity from the new pool and exchanges the Old Cell tokens returned from the migration for native tokens. At this point, there are a large number of Old Cell tokens in the old pool but no native tokens, so the attacker exchanges the Old Cell tokens back into native tokens, thus completing the profit. After that, the attacker repeats the migration operation.

Security Recommendations

1. When migrating liquidity, one should fully consider the changes in the quantities of the two tokens in the old and new pools, as well as the current token prices. Directly calculating the quantities of the two currencies through the trading pair can be easily manipulated.

2. Before the code goes live, it is essential to conduct a comprehensive security audit to prevent potential vulnerabilities and attack risks.

This incident once again emphasizes the importance of implementing strict security measures in DeFi projects, especially when it comes to complex operations such as liquidity migration. Project teams need to be more cautious and ensure that all possible attack vectors are fully considered and mitigated.