Slow Mist: NimbusPlatform was attacked, and the attacker made a profit of about 278 BNB

According to the intelligence of the SlowMist security team, on December 14, 2022, the project NimbusPlatform on the BNB Chain was attacked, and the attacker made a profit of about 278 BNB. The attack process is as follows: 1. The attacker first executed a transaction (0x7d2d8d) 8 days ago, exchanging 20 BNB into NBU_WBNB and then into GNIMB tokens, and then transferred the GNIMB tokens into the Staking contract as a pledge, which is the basis for the attack. prepare. 2. The attack transaction (0x42f56d3) was officially launched 8 days later. First, 75,477 BNBs were lent through flash loans and exchanged for NBU_WBNB, and then most of the NIMB tokens in the pool were exchanged with these NBU_WBNB tokens. 3. Then call the getReward function of the Staking contract to extract rewards. The calculation of rewards is positively related to the value of rate, and the value of rate depends on the prices of NIMB tokens and GNIMB tokens in the pool. Since NIMB tokens The price is calculated based on the number of tokens in the manipulated pool in the flash loan in the previous step. As a result, it becomes higher due to the exchange of a large number of tokens from the flash loan, and the final calculated reward will be more. 4. The attacker finally exchanged the last obtained GNIMB tokens and owned NIMB tokens into NBU_WBNB tokens and then into BNB, and returned the flash loan profit. The main reason for this attack is that the calculation of rewards only depends on the number of tokens in the pool, which leads to being manipulated by flash loans to obtain more rewards than expected. The SlowMist Security Team stated that it is recommended to ensure the security of the price source when calculating token awards.