CertiK: KyberSwap vulnerability exists in the implementation of Elastic's computeSwapStep() function
CertiK posted on social media that the vulnerability in the KyberSwap attack exists in the implementation of the computeSwapStep() function in KyberSwap Elastic. This function calculates the actual exchange input/output amounts to be deducted or added, the exchange fee to be charged, and the resulting sqrtP. The function first calls the calcReachAmount() function, which concludes that the attacker's slippage will not cross the scale line, but incorrectly generates a slightly larger price than the targetSqrtP calculated by calling "calcFinalPrice". Therefore, liquidity was not removed, resulting in the attack. The attacker performed precise calculation operations on the liquidity pool within the empty scale range, using cross-exchange liquidity counts to deplete many KyberSwap pools containing low liquidity.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Crypto liquidations reach $470M as Bitcoin retraces, altcoins surge
Mastercard and JP Morgan Team up to Enhance Cross Boarder Payments
SAND breaks through $0.8, with a 24-hour increase of 81.2%
In the past 12 hours, the entire network has liquidated 317 million US dollars, mainly long orders