DeFi protocol token NFD crashes by 99% after a flash loan attack

Flash loans allow users to borrow a high amount of assets without having to provide any upfront collateral, this is often used by miscreants to launch attacks on DeFi protocols.

New Free DAO, a decentralized finance (DeFi) protocol, faced a series of flash loan attacks on Sept. 8, resulting in a reported loss of $1.25 million. The price of the native token has dropped by 99% in the wake of the attack.

Unlike normal loans, several DeFi protocols offer flash loans that allow users to borrow large amounts of assets without upfront collateral deposits. The only condition is that the loan must be returned in a single transaction within a set time period. However, this feature is often exploited by malicious adversaries to gather large amounts of assets to launch costly exploitations targeting DeFi protocols.

Blockchain security firm Certik alerted the crypto community on Thursday about the 99% price slippage of the NFD token due to a flash loan attack. The attacker reportedly deployed an unverified contract and called the function “addMember()” to add itself as a member. The attacker later executed three flash loan attacks with the assistance of the unverified contract.

#CertiKSkynetAlert

New Free Dao – $NFD was exploited via flash loan attack gaining the attacker 4481 WBNB (approx. ~$1.25M) causing the token to slip in price 99%.

The attacker has connections to Neorder – $N3DR attack from 4 months ago where they took 930 BNB at the time. pic.twitter.com/5Rcht3YiIK

— CertiK Alert (@CertiKAlert) September 8, 2022

The attacker first borrowed 250 WBNB worth $69,825 via flash loan and swapped all of them for the native token NFD. The contract was then used to create multiple attack contracts to claim airdrop rewards repeatedly. The attacker then swapped all the airdrop rewards for WBNB benefiting 4481 BNB.

Out of the 4481 BNB, the attacker returned the borrowed loan (250 BNB) and swapped 2,000 BNB for 550,000 BSC-USD. Later, the attacker moved 400 BNB to the popular coin mixer service Tornado Cash.

Fund Movement From NFD Attacker Wallet to Tornado Cash Source: BSC Scan

Certik also notified that the hacker behind the flash loan attack on NFD was related to those who exploited Neorder (N3DR) in May earlier this year. Later, another blockchain security firm Beosin told Cointelegraph that the attackers behind both the exploits could be the same.

Related: Solana-based stablecoin NIRV drops 85% following $3.5M exploit

Beosin also highlighted another vulnerability with the NFD protocol that could be further used for another type of flash loan attack. The security firm said that the price could be manipulated since they are calculated “using the balance of USDT in the pair, so it may lead to flash loan attack if exploited.”

3/ Although unrelated to this attack, we also find another vulnerability in the $NFD contract that may lead to price manipulation. pic.twitter.com/kKvx4hRdE4

— Beosin Alert (@BeosinAlert) September 8, 2022

Flash loan attacks have been increasingly popular among hackers due to the low risk, low cost and high reward factors. On Sept. 7, Avalanche-based lending protocol Nereus Finance became a victim of a crafty flash loan attack resulting in a loss of $371,000 in USDC. Earlier in June, Inverse Finance lost $1.2 million in another flash loan attack.

Related Posts

Coinbase expands to Australia with focus on institutions in ‘months to come’

With an expanded Australian offering, Coinbase’s VP of international and business development said the exchange faced “tough questions” from regulators and policymakers about its services. United States-based…

Musk’s deal for Twitter looks set to go with original $44B price tag

Twitter appears ready to move forward with the deal for Elon Musk to buy Twitter, announcing in an Oct. 4 post they intend to close the transaction…

‘New frontier’ of crypto laundering involves cross-chain bridges and DEXs: Elliptic

Curve, Uniswap, 1inch, and the Ren bridge were the top platforms of choice for laundering illicit crypto, according to Elliptic. New research from blockchain analytics and crypto…

Bitwise launches Web3 ETF for institutional and retail investors

The ETF tracks the Bitwise Web3 Equities Index, with over 85% exposure to companies in Web3. Bitwise Asset Management announced on Oct. 3 a new exchange-traded fund…

Billionaire Hedge Fund Founder Ray Dalio Steps Down as Co-CIO of Bridgewater Associates

Billionaire hedge fund founder Ray Dalio has stepped down as chief executive of Bridgewater Associates, according to a transfer of voting rights on September 30. Bridgewater’s co-chief…

Oryen (ORY) Huge Opportunity To Become Bigger Than Elrond (EGLD), Quant (QNT), And OKB (OKB)

The cryptocurrency market is heating up and Oryen (ORY) is positioning itself as a significant player. The project has a lot of potential to become bigger than…

Generated by Feedzy