NimbusPlatform Lost 278 BNB By Flash Loans Attack
According to the SlowMist security team’s intelligence, the NimbusPlatform project on the BSC chain was targeted on December 14, 2022, and the perpetrator profited by around 278 BNB.
To prepare for the attack, the attacker first conducted a transaction (0x7d2d8d) 8 days ago, swapping 20 BNB for NBU WBNB and subsequently for GNIMB tokens, and then transferred the GNIMB tokens to the Staking contract as a pledge.
Eight days later, the attack transaction (0x42f56d3) was formally initiated. First, 75,477 BNBs were lent via flash loans and converted for NBU WBNB, after which the majority of the nimbus tokens in the pool were exchanged for these NBU WBNB tokens.
Then, to extract rewards, use the Staking contract’s getReward method. The calculation of rewards is proportional to the value of rate, and the value of rate is determined by the values of NIMB and GNIMB tokens in the pool. Because NIMB tokens are determined by the number of tokens in the manipulated pool in the previous step of the flash loan. As a result of the exchange of a large number of tokens in the flash loan, it becomes higher, and the final calculated reward will be more than 4. The attacker eventually exchanged the last obtained GNIMB tokens and owned nimbus tokens into NBU WBNB tokens and then into BNB, and returned the flash loan profit.
The fundamental cause for this attack is that the calculation of rewards is based solely on the quantity of tokens in the pool, which allows flash loans to manipulate the system to collect more rewards than planned. When calculating token payouts, the SlowMist security team recommended that the security of the price source be maintained.
Attack transaction reference: https://bscscan.com/tx/0x42f56d3e86fb47e1edffa59222b33b73e7407d4b5bb05e23b83cb1771790f6c1
DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.
Join us to keep track of news: https://linktr.ee/coincu
Website: coincu.com
Chubbi
Coincu News
Author
News
NimbusPlatform Lost 278 BNB By Flash Loans Attack
According to the SlowMist security team’s intelligence, the NimbusPlatform project on the BSC chain was targeted on December 14, 2022, and the perpetrator profited by around 278 BNB.
To prepare for the attack, the attacker first conducted a transaction (0x7d2d8d) 8 days ago, swapping 20 BNB for NBU WBNB and subsequently for GNIMB tokens, and then transferred the GNIMB tokens to the Staking contract as a pledge.
Eight days later, the attack transaction (0x42f56d3) was formally initiated. First, 75,477 BNBs were lent via flash loans and converted for NBU WBNB, after which the majority of the nimbus tokens in the pool were exchanged for these NBU WBNB tokens.
Then, to extract rewards, use the Staking contract’s getReward method. The calculation of rewards is proportional to the value of rate, and the value of rate is determined by the values of NIMB and GNIMB tokens in the pool. Because NIMB tokens are determined by the number of tokens in the manipulated pool in the previous step of the flash loan. As a result of the exchange of a large number of tokens in the flash loan, it becomes higher, and the final calculated reward will be more than 4. The attacker eventually exchanged the last obtained GNIMB tokens and owned nimbus tokens into NBU WBNB tokens and then into BNB, and returned the flash loan profit.
The fundamental cause for this attack is that the calculation of rewards is based solely on the quantity of tokens in the pool, which allows flash loans to manipulate the system to collect more rewards than planned. When calculating token payouts, the SlowMist security team recommended that the security of the price source be maintained.
Attack transaction reference: https://bscscan.com/tx/0x42f56d3e86fb47e1edffa59222b33b73e7407d4b5bb05e23b83cb1771790f6c1
DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.
Join us to keep track of news: https://linktr.ee/coincu
Website: coincu.com
Chubbi
Coincu News
Other Posts
Related Posts
Latest
2025 Crypto Bull Run: Ethereum Hits $10000, Cardano Crosses $10, and RXS Token Price Skyrockets to $15—How Much Richer Are You?
WeFi to Enter New Phase of DeFi Following November $WFI Token Generation Event
Top 8 Ways to Make Passive Income Through Cryptocurrency in 2024
Press Release
2025 Crypto Bull Run: Ethereum Hits $10000, Cardano Crosses $10, and RXS Token Price Skyrockets to $15—How Much Richer Are You?
WeFi to Enter New Phase of DeFi Following November $WFI Token Generation Event
