Hopenlend 攻击事件详细技术分析

Author Shenzhen Zero Time Technology In this paper, we will introduce in detail how the poachers attack. It is a decentralized virtual currency lending platform, which can realize instant loans according to the status of the fund pool without the need for separate matching between the two parties. The operation mode is similar to that of other projects as shown in the following figure. In short, the hacker attack process is mainly divided into two parts: the trading pool used is illiquid, and the liquidity is raised, and then all tokens are hollowed out to solve the problem of loss of accuracy. Among them, all the money put into the hollowing-out hacker's pre-attack in China needs to be briefly understood before the specific analysis of the attack. The relevant content is that the users of decentralized lending platforms get the corresponding ones by depositing the underlying assets, and conversely, the conversion ratio is controlled by the liquidity index. Simply speaking, the liquidity index is the value, for example, when the corresponding one can be exchanged for a corresponding underlying asset, which is carried out through income. The calculation method is as follows. The corresponding code is as follows. In this attack, simply speaking, the value raised by the hacker by manipulating the liquidity index distorts the value. Finally, a small unit is used to borrow a large amount of other underlying assets, thus hollowing out the underlying assets of other pools. Then, the hacker repeatedly and finally hollows out all the attack steps transferred to the pool by using the problem of precision loss. Analyze in detail the liquidity index obtained by the hacker by depositing the underlying assets and then manipulating it through repetition. Finally, the price was inflated by hollowing out all the underlying assets except the minimum collateral. First, the hacker borrowed from it, and at the same time, the corresponding pool was used by the hacker as a deposit certificate. Then the hacker borrowed from it, and then transferred to the pool where the smallest unit was left. The neutralization operation was only carried out in the first time. This is because the hacker borrowed from it, and then the hacker borrowed from the corresponding pool of the underlying assets. The pool is not initialized, so the corresponding reason is that the pool is destroyed. Let's take a look at how it is updated in the process. First of all, the corresponding total value is the income of this time, that is, the added value. Because the loan interest rate is and the profit of the pool belongs to the liquidity provider, the profit generated to the pool every time a hacker borrows is, so in the above formula, it is simply said that the added value of the pool is the total value of the pool. Therefore, the value that hackers want to raise is to make the total value of the pool as small as possible, which explains why hackers want to transfer it to the pool after borrowing, because the operation will be destroyed, but at present, if the pool is not transferred, there is no asset in the pool at the beginning. At present, because of the lightning loan, hackers have been locked in and cannot destroy the corresponding hackers. In order to make the total value of the pool as small as possible, hackers have left the smallest unit, so the pool is also destroyed and the smallest unit is left. Because the corresponding pool is not initialized, the total value of the current pool at this time is the smallest unit, and the value after the first time is updated to the value for the second time. Hackers borrow money for the first time, so they get it through the algorithm. The following figure shows the value after each time. Because there are still hackers' values in the pool and the value is huge, the steps of hacking the collateral in the pool are detailed by borrowing all tokens. Analysis of hackers' use of precision loss, repetition and operation hollowing out all the hackers who invested in the previous attack were first deposited and then taken out. Because at this time, the hackers have been promoted to the back pool, and the hackers have taken out the ones that should be destroyed. However, due to truncation, only the destroyed codes were destroyed. In order to scale the functions that need to be destroyed, we can see the liquidity index of the number of the target assets, but here in order to reduce mathematics. The code used in the division here is as follows: because the calculation formula of the number to be destroyed is the liquidity index of the number of assets to be destroyed, the liquidity index of the number of assets to be taken out at this time is the liquidity index at this time, because we can get the number to be destroyed by calculation, but because of the integer division operation here, it is equivalent to making a floor and removing decimal places, so the number to be destroyed is finally one, that is It's equivalent to only destroying the value, so the hacker makes a profit through the precision loss loophole, and then the hacker gets the pool by continuing to deposit, because the liquidity index at this time is equivalent to the smallest unit, that is, the value is, so the pool is left, and then the hacker takes out the cut-off and only destroys it, that is to say, the hacker can get it out of thin air by depositing and then taking out, and the hacker finally empties the loan invested before by repeating this operation, thus returning it to all attacks. The attack flow has been completed and summarized. The hacker first repeatedly manipulated the liquidity index corresponding to the target asset due to the poor liquidity of the pool, so that its value was distorted. Then he lent all other target assets through minimal mortgage, and then repeatedly accessed and emptied the target assets invested in the hacking attack by using the loophole of the loss of division accuracy in the contract. So far, the hacker has completed a complex attack on the project, and all the assets hollowed out. 比特币今日价格行情网_okx交易所app_永续合约_比特币怎么买卖交易_虚拟币交易所平台

注册有任何问题请添加 微信：MVIP619 拉你进入群

文章转载注明 网址：https://netpsp.com/?id=63033