😐Transit Finance rekt ~ $110k

HashingBits | Week- 51

In brief ⚡

• On the 21st of December 2023, Transit Finance was attacked on the BNB chain. The attack was made due to a lack of validation on the swap path supplied by users. Around $110k was stolen by the attacker.

---

Hacks and Scams⚠️

---

Transit Finance

Amount of Loss:  ~ $110k

Analysis

• TransitFinance experienced a hack resulting in a $110,000 loss across Binance Smart Chain (BSC) and Ethereum (ETH) networks.

• The attacker manipulated input validation for pools, providing a forged pool and WBNB/BUSD pool path.

• The exploiter received initial funding from Tornado Cash, a privacy-focused decentralized finance (DeFi) protocol.

• Lack of validation on user-supplied swap paths allowed the attacker to manipulate the actualAmountIn, leading to unintended asset swaps and losses.

• The attacker directed funds to a PancakePair created earlier, initially yielding no profit but obscuring the subsequent exploitation.

• The attacker inflated their tokens' price, then removed liquidity from the PancakePair, hiding the illicit gains.

---

Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

---

Tweets

1. Would stay extra vigilant over the holidays…

2.  Everything I've learned about auditing in 2023

3. 🔍 Starting a large (>5k SLOC)  audit can be daunting. Here's a proven method to kickstart your audit efficiently:

4. 【0day】this is the vulnerability I found ...

5. In January 2023, I reported two bugs to the Cronos Gravity Bridge Immunefi project. These bugs would allow an attacker to halt all or parts of the bridge.

GitHub Repos

1.  eth-phishing-detect

Articles 

1. Cracks in the Code: Understanding the Vulnerabilities of AMM Protocols

2.  $780,000 in 3 months Bug Bounty! 

3. Liquidations in Decentralized Finance: A Comprehensive Review

4. The interest rate model of AAVE V3 and Compound V2

5. Halting the Cronos Gravity Bridge

---

Web3 Community Spotlight🔦

---

Note - all the respective links has been embedded in the image

2022 has been a tumultuous year for the Web3 industry, marked by both major rug pulls and significant security breaches. 

In recent years, RPC endpoints in blockchains became pivotal elements and instruments for dApps building. At the same time, even

Introduction The innovative zkEVM technology presents a groundbreaking method for executing smart contracts, focusing on both privacy and performance. This

---

---

Thanks for reading HashingBits! Share a summary of our newsletter on your social media platforms, tag us, and use the #AwareToEarn hashtag, and you could win 10 USDT as a reward! Help us build a safer Web3 ecosystem and have a chance to earn rewards and support our work.

---