黑客利用一個漏洞攻擊8次獲利630 萬美元，幣安智能鏈被盯上了？

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Belt Finance 是一種基於幣安智能鏈（BSC）的去中心化借貸協議，5 月 29 日，攻擊者通過智能合約開始對 4Belt BLP 池發起閃電貸攻擊。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"據悉，攻擊方創建了一份使用 PancakeSwap 進行閃電貸的智能合約，並利用 BeltBUSD 池及其底層策略協議先後對合約內容執行了 8 次，藉此攫取了高達 6234753 BUSD 的收益。BeltBUSD 金庫用戶遭受 21.36% 的資金損失，而 4Belt 幣池用戶則遭受 5.51% 資金損失。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":4},"content":[{"type":"text","text":"攻擊過程"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"據 Belt Finance 團隊介紹，攻擊者首先利用 PancakeSwap 中的漏洞獲得了總值 3.9 億 BUSD 的閃電貸額度，這已經接近 PancakeSwap 上全部 BUSD 池所能提供的最大 BUSD 金額。之後，攻擊方將其中約 2 億 BUSD 存入 BeltBUSD 金庫（使用 Venus 策略協議），並藉此極大提升了 Venus 策略的整體佔比。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在攻擊活動發生之前，BeltBUSD 金庫的協議比例爲：Venus 約佔 6000 萬 BUSD，Alpaca 佔 6000 萬 BUSD，Ellipsis 佔 6000 萬 BUSD，而 ForTube 約佔 2000 萬 BUSD，總量約爲 2 億 BUSD。但在吸納了攻擊者的存入之後，Venus 掌握了約 2.6 億 BUSD，也讓 BeltBUSD 的總儲量快速提升至 4 億左右。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"攻擊者同時還將 1.9 億 BUSD 轉移至 Ellipsis.fi 3pool，並將這 1.9 億 BUSD 兌換爲約 1.695 億 USDT。此次兌換令 Ellipsis 3pool LP 值在短時間內猛增。3pool LP 的供應關係雖然沒有改變，但這 2150 萬美元的差值仍然令 3pool LP 快速增值約 3%。這又將 4Belt 池 Ellipsis 策略的幣值佔比由 6000 萬 BUSD 增加至 6180 萬 BUSD，也讓整個 BeltBUSD 金庫總值由 4 億 BUSD 增加至 4.018 億 BUSD（漲幅約 0.5%）。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在此之後，攻擊者開始從 BeltBUSD 金庫中提現離場，獲得了 2 億 BUSD 總額中約 0.5% 的存入收益，即約 100 萬 BUSD（進場前 2 億 BUSD，離場時 2.01 億 BUSD）收益。接下來，攻擊方在 Ellipsis 上將 USDT 兌換回 BUSD，令 LP 重新迴歸之前的正常值，而 BeltBUSD 金庫則因此憑空損失掉了這 100 萬 BUSD。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"之後，攻擊者通過智能合約多次重複執行這同一筆交易（由 Tx gas 允許的上限而定），去掉閃電貸費用與 Ellipsis 掉期費用外的即爲最終實際獲利。接下來，攻擊者將 BUSD 形式的利潤轉至自有地址並兌換爲 anyETH，再使用 Nerve Bridge 將這筆 anyETH 發往以太坊主網。整個攻擊流程從 PancakeSwap 閃電貸開始，到向以太坊主見發送 anyETH 結束，前後共重複了 8 次。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":4},"content":[{"type":"text","text":"解決方案"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在使用 StrategyEllipsis 的情況下，Belt Finance 團隊使用 isPoolSafe() 限制發生價格缺口時的提現活動。現在，面向各項策略，團隊決定通過檢查 Ellipsis 的掉期狀態解決這一隱患。當 USDC、BUSD 與 USDT 之間存在比例偏差時，會限制用戶的提現與存入操作。如此一來，攻擊者將無法順利操縱 Ellipsis LP 價格。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在開發過程中，Belt Finance 團隊添加了以下函數，以防止 Ellipsis Pool 值出現異常時被攻擊者所利用："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/wechat\/images\/7a\/7ac841294770375048a9e6c839db8528.png","alt":null,"title":null,"style":null,"href":null,"fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/wechat\/images\/b5\/b5fb43d9dd2dfd7e1ee4d9c53606d7dc.png","alt":null,"title":null,"style":null,"href":null,"fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/wechat\/images\/2c\/2c3d0d2d1186cd23e0bdee7aeacf413e.png","alt":null,"title":null,"style":null,"href":null,"fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這裏的 isPoolSafe 函數將通過衡量 Ellipsis 3pool 的代幣比率（即包含的最大與最低代幣數量間的比值）來檢查其健康狀況。此函數能夠防止 Belt 受到異常 StableWap AMM 比率的影響。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"isPoolSafe 函數將在 _deposit() 與 _withdraw() 函數執行之前與之後檢查池健康狀況，如果池比率發生偏差，則交易將被直接還原以防止語句的實際更新。如此，Belt Finance 團隊就能有效防止 Ellipsis 策略受到閃電貸攻擊的影響。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/wechat\/images\/cb\/cbd9a74ef7085e69b72b61eb2da88f5c.png","alt":null,"title":null,"style":null,"href":null,"fromPaste":false,"pastePass":false}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過使用 Ellipsis 掉期，攻擊者即可瞬時操縱 ellipsisSwap 合約中 BUSD、USDC 與 USDT 的比例，藉此操縱 3pool LP 的價格。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在之前的設計中，Belt Finance 團隊並沒有考慮到負責計算 Ellipsis 策略中 wantTotalLocked() Ellipsis 3Pool 比率的 epsToWant() （一項 MultiToken 函數）被破壞並影響到其他策略存取交易的情況。這項函數只是與 Read 相關的接口，Belt Finance 團隊表示沒有想到它會與閃電貸發生直接關聯。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"結果，閃電貸導致 Ellipsis 策略中的 wantTotalLocked 值增加，MultiVault 則以高於實際資產量的值運行了提取操作。此次攻擊活動，在根本上利用的也正是這項漏洞。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":4},"content":[{"type":"text","text":"黑客盯上 BSC"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Belt Finance 只是 BSC 上被攻擊的項目之一。5 月份，PancakeBunny 遭受攻擊，損失了 300 萬美元；類似的項目 Bogged Finance 也在閃電貸款攻擊中損失了幾乎相同的金額；Burgerswap 在一次閃電貸攻擊中損失 720 萬美元。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"“最近已經接連發生超過 8 起針對 BSC 鏈上項目的閃電貸攻擊，我們認爲現在有一個有組織的黑客團隊盯上了 BSC。”BSC 官方發文表示。The Block 數據顯示，因爲近期的黑客攻擊事件，BSC 已有部分鎖倉資金迴流至以太坊，總鎖倉量回落至 20 億美元。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"因此，BSC 官方呼籲所有 DApp 採取如下措施進行預防保護："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"numberedlist","attrs":{"start":1,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","text":"與審計公司合作進行另一次健康檢查。如果是分叉項目，請反覆檢查相對原始版本進行的更改；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","text":"採取必要的風險控制措施，實時主動監控異常情況，一旦出現異常及時暫停協議；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"text","text":"制定應急計劃，以防真的出現最壞的情況；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":4,"align":null,"origin":null},"content":[{"type":"text","text":"如果條件允許可設定漏洞賞金計劃；"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":5,"align":null,"origin":null},"content":[{"type":"text","text":"安全公司 PeckShield 和 CertiK 也爲 BSC 項目的任何安全諮詢服務提供綠色通道。"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"隨着 DeFi 發展以及整個加密社區的發展，黑客攻擊事件一直層出不窮。區塊鏈網絡和鏈上項目需要更多的安全規範和相應審查機制來防止攻擊事件頻繁發生。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"相關鏈接："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https:\/\/belt-fi.medium.com\/","title":"","type":null},"content":[{"type":"text","text":"https:\/\/belt-fi.medium.com\/"}]}]},{"type":"heading","attrs":{"align":null,"level":5}}]}