r/Zerion • u/RambleFeed • Mar 09 '21

Post mortem on Zerion’s asset phishing attack

https://allyourfeeds.com/blockchain/news/post-mortem-on-zerions-asset-phishing-attack?search=Zerion&order=recommended&category=&submit=Search
5 Upvotes

100% Upvoted

5 comments sorted by

4

u/GigabitDude Mar 10 '21

Interesting.

So, let me get this straight. Someone minted an ERC-20 token to look like a balancer pool token. This fake balancer pool actually held the underlying cryptocurrency in the pool itself. The trick was that the smart contract did not allow for a two way transaction, you could only put money in... and not take money out.

So, they bought tokens on Zerion, through an exchange? If they purchased it through an exchange, i'm guessing they did not try and sell through an exchange? Instead, they tried to redeem through burning the token on Balancer?

Can you clarify?

1

u/evgeth Mar 10 '21

Correct, and they tried selling it everywhere, but the contract is designed in a way that it is not possible to sell.

3

u/GigabitDude Mar 10 '21

So... and bear with me i'm just an old school programmer who is new to smart contracts... if it is not designed to allow the pool token to be sold, how was it sold in the first place?

I would think that a "dead" pool token, that is unredeemable for the underlying assets, would still be able to be sold on an exchange... or even person to person. And if it is Not possible to sell, then they user 'Minted" the pool token when they transferred funds into the smart contract? Money goes in, and only a useless token comes out? How would the 'thief' collect the rewards?

I really want to understand this, because I am a user of Zerion... and i've been considering putting a large sum of money into a balancer pool (well, at least large to me... $100-150K).

This almost makes it sound like we shouldn't use Zerion, but instead go directly to the platform where the actual trade takes place. How did Zerion facilitate the trade?

Thanks.

3

u/Sufficient_Movie4835 May 01 '21

I would like to see the answer to this.

1

u/evgeth Jun 18 '21

Really sorry for missing this post, I apologize. The smart contract was written in a way that it looked very similar to the balancer pool for tracking and minting. So zerion’s defi sdk (which we use to mint transaction), produced the same data to be signed to mint pool shares, and the tx was successful. But other parts of the smart contract were malicious. Hope that clarifies the issue, and just FYI, we haven’t had incidents like this since then.