TL;DR#

On October 11, 2023, the BlackHole Token was exploited on the BNB Chain, resulting in the loss of over 2000 BNB, worth approximately $1.275 million.

Introduction to BlackHole Token#

The BlackHole Token is a protocol on the BNB chain.

Vulnerability Assessment#

The root cause of the exploit is price manipulation of the underlying assets.

Steps#

Step 1:

We attempt to analyze the attack transaction executed by the exploiter.

Step 2:

The attacker initially took a flash loan of a substantial amount of USDT and then invoked a call to the `0x33688938` function of the unverified affected contract.

Step 3:

This takes the earlier USDT from the attacker, adds liquidity to the pair contract, and then returns BH tokens for it, with the standard liquidity ratio being approximately 1 USDT:100 BH.

Step 4:

The exploiter was then able to manipulate the token price by swapping 22 million USDT for the BH token through the trading pair.

Step 5:

The exploiter then invoked a call to the `0x4e290832` function to burn the BH token, remove liquidity from the pair, and drain USDT out of the contract.

Step 6:

As a result, the liquidity removal ratio was significantly altered to 1 USDT:2 BH tokens, allowing the attacker to withdraw more USDT than what they had initially provided.

Step 7:

The borrowed flash loans were repaid, and the attacker bagged a significant profit from the price manipulation, which was ultimately laundered into Tornado Cash.

Step 8:

Later, it became clear that a MEV bot was responsible for the attack, making the exploit the highest-ever single arbitrage with the biggest profit margin on the BNB chain.

Solution#

The BlackHole Token exploit has brought to the forefront the indispensable need for robust security measures within DeFi protocols, emphasizing not just code robustness but also economic safeguards and operational best practices. One of the foundational steps towards ensuring a secure environment is the thorough auditing and verification of smart contract contracts. Before any protocol goes live, it must be subjected to rigorous scrutiny by reputable audit firms to identify and rectify potential security loopholes, including those that could lead to exploits like price manipulation. Moreover, the transparency afforded by verifying contracts on blockchain explorers cannot be undervalued, as it engenders user trust and confidence.

In the realm of DeFi, where economic incentives can often influence user behavior, implementing economic safeguards becomes crucial. This involves setting up systems like slippage tolerance, maximum transaction limits, and fair launch protocols, which collectively work to deter large-scale manipulative actions by making them economically unviable. Another layer of defense is the introduction of timelocks for critical protocol operations. By enforcing a mandatory delay for significant changes, timelocks afford developers and the community at large sufficient time to intercept any malicious intents or actions.

Given that the exploit was initiated with a flash loan, specific mitigations tailored to these mechanisms are essential. Protocols should consider techniques to distinguish typical user interactions from flash loan transactions, possibly by inspecting transaction patterns or imposing additional fees on flash loan operations, thereby disincentivizing exploitative attempts. Furthermore, where price manipulation stands central, it becomes imperative to leverage Oracle systems like ChainLink, which amalgamate data from numerous sources to provide accurate price feeds. Utilizing multiple reliable price feeds and medianizers ensures that asset prices reflect a consensus from various sources, drastically reducing the feasibility of price manipulation.

While these comprehensive measures are crucial, there are times when vulnerabilities may unexpectedly arise. This is where we at Neptune Mutual come in to shield end-users. If the team associated with BlackHole Token had collaborated with us to set up a dedicated cover pool before the exploit occurred, the consequences of the incident could have been substantially lessened. We at Neptune Mutual are deeply familiar with the nuances of the DeFi world, and it's this understanding that motivates us to offer insurance to users who could suffer losses from smart contract vulnerabilities.

With us, users don't have to go through the trouble of providing detailed evidence of their losses. As soon as a problem is verified and resolved through our incident resolution process, we shift our priority to quickly distributing compensation, ensuring swift support for those impacted.

Our marketplace functions on several prominent blockchain infrastructures, including Ethereum, Arbitrum, and the BNB chain. This broad network allows us to support a wide array of DeFi users, providing them protection against possible vulnerabilities and strengthening their trust in the ecosystem.

Reference Source Beosin