Fortress attack event analysis
Fortress Loans attacked on May 9, 2022. Fortress- Decentralized Lending & Stablecoin Protocol Fortress is a decentralized finance lending and stablecoin protocol on BSC. At present, the project has lost about 1048.1 ETH and 400,000 DAI (total value of about 2.98 million US dollars).
0x02 Attack information
- Attacker’s main exploit transaction
0x13d19809b19ac512da6d110764caee75e2157ea62cb70937c8d9471afcb061bf
- Attacker’s main exploit transaction
0xA6AF2872176320015f8ddB2ba013B38Cb35d22Ad
- Attacker-created contract address
0xcd337b920678cf35143322ab31ab8977c3463a45 (self-destructed)
0x0db3b68c482b04c49cd64728ad5d6d9a7b8e43e6 ((tool contract for proposal and voting)
0x39e7fc9f6565c68104b01689ffc0487afbf06656 (The tool contract for the attacker’s pre-testing)
- Oracle related contract address
0xc11b687cd6061a6516e23769e4657b6efa25d78e
- Governance related contract addresses
0xe79ecdb7fedd413e697f083982bac29e93d86b2e
0x03 Attack Analysis
- The attacker exchanged about 11.126 ETH for about 400413.3278 FTS Tokens through PancakeSwap: Router v2
2. The attacker conducted a lot of tests before the official attack, and launched a malicious proposal №11 to Fortress Governor Alpha (to change the mortgage coefficient of FTS Token in the loan contract), and then the attacker used the exchanged FTS Token to vote on his proposal Yes vote. At the same time, deposit FTS Token into the loan contract as collateral.
3. After the proposal is passed, the attacker uses the attack contract to execute the proposal and uses the submit() function in the oracle-related contract to update the price used by the loan contract. By updating the mortgage coefficient, the value of the attacker’s collateral (FTS) is changed. A substantial increase;
4. The attacker uses the FTS Token in exchange for a large number of other Tokens, and eventually converts all other Tokens into ETH and DAI Tokens.
0x04 Vulnerability Details
Through the analysis of the attack transaction, it can be seen that the attacker executes the malicious proposal through the governance contract, and tampered with the relevant parameters of the price oracle in the Fortress Loans project through the malicious proposal, resulting in a surge in the FTS currency price and ultimately profit;
The successful execution of the malicious proposal is due to a design flaw in the governance contract used by Fortress Loans; according to the relevant configuration in the governance contract source code (the minimum number of votes to agree to the proposal) is less than the amount held by the attacker, the proposal was passed.
The minimum FTS Token required for successful voting is 400,000, but due to the low price of FTS Token, the attacker only exchanged about 11 ETH for more than 400,000 FTS Token.
By analyzing the source code of the oracle contract, it can be found that the submit() function used to update the price can be called by any role as follows:
①Only the number of signatures is verified, but the validity of the signature address obtained at ② is not judged so that any number of address signatures can be used to bypass. ③The necessary verification statements are commented out, so the number of votes is not verified. These problems together lead to the submit function that can be called by any person.
0x05 summarize
According to this attack event, the security risks are the design flaws in the governance-related functions on the chain, and the function of updating the price in the oracle contract can be called arbitrarily. It can be seen from the attacker’s transaction that the attacker has been planning for a long time, starting to test the project a month ago or even earlier. A series of attack contracts or attack auxiliary contracts have been created, and the main attack contract has self-destructed after completing the attack, and the profit from the attack has also been transferred to the Ethereum through cross-chain bridges such as cBridge (Celer Network). Subsequent transactions in the series are sent to the Tornado Cash mixer.
Join Coinmonks Telegram Channel and Youtube Channel learn about crypto trading and investing
