The Value DeFi project on the Binance Smart Chain (BSC) blockchain was attacked by hackers last night. The target of the attack was the vSwap automated market maker included in it. According to analyst Igor Igamberdiev, about $11 million was stolen from the project pools.
vSwap supports liquidity pools with an asset ratio other than 50/50. It was on them that the attack was carried out. "All of our pools that do not use a 50/50 asset ratio have been exploited. We are working to determine the exact cause, but please stop buying VALUE and vBSWAP until our team presents an official solution, " the developers wrote.
A total of 15,000 BNB, 2,700 FARM, 1,700 BASv2, 8.5 million BDO, 68,300 BUSD, 41,000 MDG, 945,000 vBOND, 1.2 million BAC, and 11,000 FIRO were stolen. The hackers exchanged the stolen assets for 3,240 anyETH in order to withdraw them to the Ethereum blockchain.
As Igamberdiev explains, initially the hacker sent part of the second token in the trading pair to its address and conducted a swap, during which he tried to withdraw a small amount of the first token and a large amount of the second. Since Uniswap only supports pools with a 50/50 asset ratio, the developers of Value DeFi used the Bancor formula, but did it incorrectly, which caused the vector to appear for the attack.
"This is not the first and far from the last case when the project team forks someone's code without a deep understanding of how it works," the analyst adds.
It is noteworthy that the co-founder of Value DeFi, Anna Tanaka, who represented the project in YouTube videos, is actually an actress and offers her services in the Flickr service. The developers themselves in Discord did not hide the true status of the co-founder. They explained their decision by the fact that one of their team members uses the name "Anna. tanika" on the network, so they decided to find a person with a similar name as the public face of the project.