CertiK: KyberSwap vulnerability exists in the implementation of Elastic's computeSwapStep() function
CertiK posted on social media that the vulnerability in the KyberSwap attack exists in the implementation of the computeSwapStep() function in KyberSwap Elastic. This function calculates the actual exchange input/output amounts to be deducted or added, the exchange fee to be charged, and the resulting sqrtP. The function first calls the calcReachAmount() function, which concludes that the attacker's slippage will not cross the scale line, but incorrectly generates a slightly larger price than the targetSqrtP calculated by calling "calcFinalPrice". Therefore, liquidity was not removed, resulting in the attack. The attacker performed precise calculation operations on the liquidity pool within the empty scale range, using cross-exchange liquidity counts to deplete many KyberSwap pools containing low liquidity.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Fireblocks and Google Cloud partner to enhance PKM security
Judge denies appeal from promotor accused in $18M crypto fraud case
Rollblock, Uniswap and Dogecoin Soar as Crypto Adoption in Developing Nations Thrives
Trump aims to make CFTC lead regulator for $3T crypto market