Logo Distributed Networks Institute

The WOOFi suffered a flash loan exploit on Arbitrum

Summary

On March 5th, WOOFi Swaps’ sPMM algorithm was exploited on the Arbitrum network. The attacker used a sequence of flash loans to manipulate the price of the WOO token due to low liquidity. The exploit occurred due to a combination of the sPMM algorithm vulnerability, incorrect price adjustment, and a failure in the fallback check mechanism. The attacker was able to use flash loans to manipulate the price of WOO and drain funds from the affected pool. WOOFi has initiated efforts to recover the funds and offered a 10% white hat bounty to the exploiter.

Attackers

The attacker market as WOOFi Exploiter 1. The hacker used the following addresses to exploit and transfer the funds:

Losses

The WooFi lost around 7.9 million USD worth 2,223.1 ETH. The stolen funds still remain in attackers’ addresses, major part on the Arbitrum chain (2023 ETH), rest part on the Ethereum chain (199 ETH) as of Mar 7,2024.

Timeline

  • March 5, 2024, 15:42 PM UTC: The attacker did first malicious transaction
  • March 5, 2024, 16:03 PM UTC: The X account named @spreekaway posted about incident.
  • March 5, 2024, 16:08 PM UTC: The exploiter started transferring stolen funds to the Ethereum chain using via Stargate Router.
  • March 5, 2024, 16:12 PM UTC: The WOOFi posted on the X account about they paused affected pools.
  • March 5, 2024, 16:37 PM UTC: PeckShield is a blockchain security company, posted on X, that WOOFI has been exploited.
  • March 5, 2024 18:40 PM UTC: The WooFi sent on-chain message to the hacker offering white hat bounty 10% of the stolen funds white hat bounty.

Security Failure Causes

Price Calculation Issue: The primary cause of the security failure was an exploit of the sPMM algorithm that controls the pricing on WOOFi Swaps. The attacker used flash loans to manipulate the price of WOO, taking advantage of low liquidity. WOOFi’s sPMM algorithm incorrectly adjusted the WOO price to an extreme value close to zero. This allowed the attacker to swap out 10 million WOO in the same transaction with almost no cost.

Fallback Check Failure: The fallback check, which is usually executed against Chainlink, did not cover the WOO token price, allowing the attacker to drain funds from the Woo pool contract (WooPPV2).