Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
#Slippage transaction
0x44e59f7 does $445k Curve zap withdraw to USDC from the new pool (before it's announced) so there is only ~50k liquidity.
Withdraws everything to USDC (after depositing equally in DAI, USDC, USDT, and BUSD)
There is only $25k USDC
$450k turns into $25k due to slippage
The "zap" (which is just a quick automation of txs), that I wrote, does not check for slippage
So now at this point, the pool is lopsided
Me and Mich notice the slippage trade
I contact one of our biggest whales for help, and ask him to execute these two trades;
#Pool Balance transactions
So now he trades 89k USDC for 465k BUSD and 89k DAI for 134k USDT
After these two trades, the pool is stable
So no exploit on the iearn tokens or curve protocol
Just my zap that wasn't expecting someone to donate 100% of the pool and then try to withdraw 400% of 1
This was not developed by DefiZap and not related to their excellent product, if they wrote it they would have checked for slippage
We did get ahold of the first trader, and we have arranged for the funds back. We couldn't get everything
There was a mini trade inbetween (another user was interacting with the pool)
That did walk away with profit, he said he won't give it back unfortunately
But we have the 465k BUSD - 89k USDC and 134k USDT - 89k DAI to give back
Net results;
-$445,882 deposit
+$25,539 USDC
+$44,707 USDT (trade 2)
+$375,490 BUSD (trade 3)
So they technically lost $146.00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment