Eleven.finance, a yield aggregator on BSC and Polygon, was exploited for a total of $4.5M. Binance Smart Chain protocols don’t have an easy year will all of the recent hacks in last months happened on that chain. I won’t rant about BSC. I did that already in my previous articles. Let’s dive into the exploit.
The exploit was possible due to a bug in
emergencyBurn() function of
ElevenNeverSellVault. There is a transfer of previously deposited funds during the function execution, but there is a lack of burning of Nerve shares to account for the transfer.
In other words, an attacker could double-spend Nerve shares he acquired during deposit to the vault by withdrawing all LP tokens he initially deposited and withdrawing the same amount by burning Nerve shares in a call to
There were 3 affected vaults, nrvBTC, nrvETH, nrvFUSDT.
Let’s see step by step what happened. Following analysis is done solely on nrvBTC vault but other vaults were drained in the same fashion.
- FlashSwap from PancakeSwap with 30.910261929777403502 BTCB
- Convert amount to nrvBTC asset (30.836)
- Deposit nrvBTC to “MasterMind” through ElevenNeverSellVault’s
depositAll()function on nrvBTC vault and receiving 30.836 11NRV token shares
ElevenNeverSellVaultnrvBTC vault to recover the initial 30.836 nrvBTC. At this point, the 30.836 11NRV token shares aren’t burned, and we can double-spend them.
ElevenNeverSellVaultusing unspent 30.836 11NRV token shares we still have from the previous step. This time, 11NRV Tokens will be burned, and we get an additional 30.836 nrvBTC in addition to the initial ones we have.
- Remove liquidity of all 61.673 nrvBTC and get 61.754288382343941084 in BTCB in return
- Repay FlashSwap
- Transfer the rest to the attacker account.
I used the tool tenderly.co to help me analyze the attacks. If you want to check how it differs from traditional etherscan, give it a go.
I can also recommend reading other overviews of the attack.
Thanks for reading, and if you like my writing, you can subscribe to my blog to receive the daily newsletter as I’m currently in the middle of 100 days of blogging challenge. Subscription box below 👇
If the newsletter is not your thing, check out my Twitter @adrianhetman, where I post and share exciting news from the Blockchain world and security.
See you tomorrow!