SlowMist: An Analysis of the Attack on BurgerSwap (Released in 2021)

According to SlowMist Zone news, on May 28, 2021, Binance Smart Chain (BSC) DeFi project BurgerSwap was hacked, resulting in a loss of $3.3 million. SlowMist Security Team immediately stepped in to analyze the situation and shares the following results:

Attack Details Analysis

BurgerSwap is an AMM project similar to Uniswap but with a different architecture. BurgerSwap’s structure is divided into [Delegate -> lpPlatform -> Pair]. The Delegate layer manages all Pair information and is responsible for creating the lpPlatform layer. The lpPlatform layer then creates the corresponding Pair contracts. In the entire architecture, the lpPlatform layer acts as the Router in Uniswap, responsible for calculating transaction data and forwarding the tokens to be exchanged to the Pair contract to complete the exchange.

The root cause of this incident lies in the architecture itself. By analyzing the attacker’s transaction behavior step by step, we can reconstruct the core of the entire attack process:

The attack started with a flash loan from Pancake, where the attacker borrowed a large amount of WBNB and then exchanged these WBNB for Burger tokens through BurgerSwap. After completing the above operations, the attacker used their own controlled tokens (the attack contract itself) and Burger tokens to create a trading pair and add liquidity through the Delegate layer, preparing for the subsequent attack.

After completing the token creation and preparation, the attacker immediately initiated a swap using the swapExactTokensForTokens function in the PaltForm layer. The exchange path was [attacker’s controlled tokens -> Burger -> WBNB].

Next, the most critical step was taken.

Since the attacker had used their own controlled token when creating the trading pair, the _innerTransferFrom function would call the attacker’s token contract during the token exchange process. Therefore, the attacker was able to re-enter the swapExactTokensForTokens function in the _innerTransferFrom function. Why did the attacker do this?

Through analyzing the code of the PlatForm’s swapExactTokensForTokens function, we can easily discover that the contract first calculates the user’s exchange data before calling the _innerTransferFrom function. Then, after the _innerTransferFrom function, it uses the pre-calculated data to forward the actual token exchange to the underlying layer. From the perspective of this function, even if an attacker reenters the swapExactTokensForTokens function, the underlying swap function is still independent and seems to have no issues. However, a behavior on the chain caught the attention of the SlowMist security team.

We were surprised to find that in the reentry exchange process, the amount of exchange did not decrease due to slippage. What could be the reason for this? It seems that the key lies in the Pair contract called by the underlying function. We further analyzed the Pair contract’s code, which is as follows:

After analyzing the code of the Pair contract, we were once again surprised to find that during the swap process, the contract did not check the exchanged values based on the constant product formula after the exchange! In other words, the Pair contract relied entirely on data from the Platform layer for the exchange, which led to the occurrence of this incident. Since the Pair layer itself does not perform a constant product check, in the process of reentrancy, the exchange data at the Platform layer was precalculated. After the _innerTransferFrom function was completed, the updated data at the Pair layer was not reflected in the Platform layer, resulting in the exchange in the reentry transaction causing slippage that did not affect the next exchange, thus resulting in losses. A visual representation of this can be seen in the following diagram:

Summary

This attack is a problem with the BurgerSwap architecture. Because the Pair layer fully trusts the data from the Platform layer and does not do its own check, the attack occurred. With the increasing frequency of DeFi security incidents, the SlowMist security team recommends that DApp developers fully understand the architecture of the protocols they are porting and consider the compatibility between the ported protocol and their own project. They should also undergo security audits by professional security audit agencies before going live to prevent the occurrence of fund losses.

Attack transaction reference:

https://bscscan.com/tx/0xac8a739c1f668b13d065d56a03c37a686e0aa1c9339e79fcbc5a2d0a6311e333

About SlowMist

SlowMist is a blockchain security firm established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, O3Swap, etc.

Website：
https://www.slowmist.com
Twitter：
https://twitter.com/SlowMist_Team
Github：
https://github.com/slowmist/