CertiK: KyberSwap vulnerability exists in the implementation of Elastic's computeSwapStep() function
CertiK posted on social media that the vulnerability in the KyberSwap attack exists in the implementation of the computeSwapStep() function in KyberSwap Elastic. This function calculates the actual exchange input/output amounts to be deducted or added, the exchange fee to be charged, and the resulting sqrtP. The function first calls the calcReachAmount() function, which concludes that the attacker's slippage will not cross the scale line, but incorrectly generates a slightly larger price than the targetSqrtP calculated by calling "calcFinalPrice". Therefore, liquidity was not removed, resulting in the attack. The attacker performed precise calculation operations on the liquidity pool within the empty scale range, using cross-exchange liquidity counts to deplete many KyberSwap pools containing low liquidity.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
First-ever Dogecoin ETP debuts in Nordics as Elon Musk boosts interest in the crypto asset
BTC breaks through $94,000
The ZKasino project borrowed 12.38 million DAI from Aave again in the past 2 hours to go long on ETH
MicroStrategy founder reiterates he will not sell BTC