Value DeFi Hack - May 5, 2021 ($10M)
Overview
Value DeFi, a Binance Smart Chain DeFi project, was hacked in May 2021. There were actually two separate incidents in early May 2021:
First Incident - Pool Reinitialization (May 5, 2021):
On May 5th 2021, at 3:22 AM UTC, the exploiter re-initialized the pool and set the operator role to himself and _stakeToken to HACKEDMONEY. The hacker obtained a ten million dollar prize without even taking out a loan.
Second Incident - vSwap Vulnerability (May 7-8, 2021):
About $11M was stolen from non 50/50 pools, as scammers managed to exploit its automated market maker (AMM) known as vSwap.
Technical Details
The attacker made a flash loan, so the vSwap contract transferred tokens to the attacker, and the key vulnerability was that the inspection could be passed through specially constructed data. During setup of the profit-sharing vStake pool, the code was migrated from the old implementation but a critical line was not included.
The combined losses from both incidents totaled approximately $21 million in Value DeFi's ecosystem on the Binance Smart Chain.
Sources