Slow Mist: The price feeding mechanism of EGD to calculate the reward is simple, which leads to the price of the token being manipulated by the flash loan and being attacked for profit

According to news from SlowMist District, the encryption project EGD Finance on BNB Chain was attacked by hackers, resulting in unexpected withdrawal of funds in its pool. According to the analysis of the SlowMist Security Team, the attack process is as follows: 1. Due to the claimAllReward rewarded in the EGD Finance contract The function will call the getEGD Price function to calculate the price of EGD when calculating the reward, and the getEGD Price function only calculates the price of EGD by dividing the balance of EGD and USDT in the pair during calculation; 2. The attacker uses this point to first pass Flash loan lends a large amount of USDT in the pool, making the price of EGD tokens become very small after calculation, so when calling the claimAllReward function to obtain rewards, more rewards will be calculated, resulting in EGD tokens in the pool Unexpected withdrawal; this incident is because the price feeding mechanism for calculating the reward when the EGD Finance contract obtains the reward is too simple, resulting in the price of the token being manipulated by the flash loan to make a profit.