Lolli, a bitcoin (BTC) shopping rewards app, announced today the close of a $10 million Series A financing round led by early Chime backer, Acrew Capital.
The round also included Banana Capital, Up North Management, and Animal Capital, the Gen. Z-focused venture capital fund founded by social media stars Josh Richards, Griffin Johnson, and Noah Beck.
Plus, this Series A funding round saw investments from influencers and entrepreneurs such as Logan Paul, Chantel Jeffries, Lauren Riihimaki of LaurDIY, Kenny Beecham, and Baron Davis.
Additionally, the raise includes a recommitment from many of Lolli’s early investors, including Alexis Ohanian’s Seven Seven Six, 3K VC, Gabriel Leydon, and Forerunner Ventures.
This new funding will aid in expanded hiring, new partnerships, and further development of Lolli’s newly launched mobile app.
Founded in 2018 by Matt Senter and Alex Adelman, Lolli gives users BTC rewards on everyday purchases.
Shoppers can use Lolli’s mobile app or browser extension to earn bitcoin rewards at more than 1,000 top retailers and Fortune 500 companies including Kroger, Microsoft, and Booking.com.
To date, Lolli users have earned more than $3.5 million in bitcoin rewards.
After what seems like a thousand years of stability and a slight downtrend, bitcoin is back. Volatility is wreaking havoc. Trading volume seems to be picking up steam. And, more importantly, the community’s morale is climbing up. In any case, what do the data and the on-chain analysis say? Are the numbers high enough to justify the excitement? Let’s explore them.
BTC price chart for 07/27/2021 on Bitstamp | Source: BTC/USD on TradingView.com
Trading Volume Is Climbing, But, Is It A Trend?
According to Arcane Research, “On Monday, the daily trading volume in bitcoin reached $9.2 billion, which is the highest daily trading volume in bitcoin recorded since June 22nd.” That could be a good sign of a healthy market making a recovery, but hold your horses. The market had been stagnant for a while, and not only that, before the spike we had “Four consecutive days bellow $3 billion.”
Related Reading | Bitcoin Trading Volume Plunges To Lowest Level Since 2020
Even though $9.2M is a promising number, take into account that “Overall, the 7-day average trading volume remains substantially below its yearly average and trading activity in bitcoin seems to be low so far this summer.” From where we stand, there’s no way of knowing if the market is picking up or if we are witnessing a statistic anomaly. We’ll have to wait and see.
BTC Daily Volume is rising | Source: Arcane Research
Volatility Is Back In Action, But, Is It Here To Stay?
Even though traditional finance is afraid of it, the Bitcoin community thrives on volatility. And, again according to Arcane Research, “Yesterday, the markets moved towards the upside, leading the 7-day volatility to climb above the 30-day volatility.” So, volatility is back, but, are we off to the races? Don’t be so sure.
“Last summer, a similar event occurred when bitcoin was consolidating throughout the summer on declining volatility, before seeing a sudden 11% gain on July 27th, 2020. Then, the market corrected back toward the lower end of the consolidation range quickly thereafter and remained within its consolidation range throughout the summer.”
Are we in the same cycle, though? So far, 2021 has been insane for Bitcoin. All the predictions fell through. All the models seem to be failing. And there’s hope. The bull run might be over, but it also might not. And if we are still in the bull run, there’s no point comparing the situation to last summer. We might be in a whole different ball game.
BTC/ USD Volatility is wreaking havoc | Source: Arcane Research
The Short Squeeze That Generated This
Everything happened “On Monday, $750 million worth of shorts got liquidated, as bitcoin climbed from $34000 to $39500. This is the largest short squeeze we’ve recorded in bitcoin, surpassing the squeeze amid bitcoin breaking its 2017 ATH on December 16th-17th.” That catastrophic event shifted Bitcoin’s tectonic plates and put volatility, trading volume, and everything in motion. How long will it last, though? That’s the question.
Related Reading | $150 Million In Short Squeeze Liquidated As Bitcoin Scales Above $53,000
About the short squeeze is worth noting that “Binance changed their API following the May 19th crash,” so the numbers might not be precise. In fact, according to Arcane Research, the situation might’ve been “severely underestimated by Bybt. This short squeeze was, therefore, very likely far larger than $750 million.”
Featured Image by Steve Buissinne from Pixabay - Charts by TradingView
Starting today, Fetch.ai (FET) is available on Coinbase.com and in the Coinbase Android and iOS apps. Coinbase customers can now trade, send, receive, or store FET in most Coinbase-supported regions, with exceptions indicated on the asset page here. Trading for these assets is also supported on Coinbase Pro.
Fetch.ai (FET) is an Ethereum token that powers Fetch.ai, a decentralized machine learning platform for applications such as asset trading, gig economy work, and energy grid optimization. Fetch.ai’s first decentralized finance application helps Uniswap users automate trading according to predefined conditions.
One of the most common requests we hear from customers is to be able to buy and sell more cryptocurrencies on Coinbase. We announced a process for listing assets, designed in part to accelerate the addition of more cryptocurrencies. We are also investing in new tools to help people understand and explore cryptocurrencies. We launched informational asset pages (see FET), as well as a new section of the Coinbase website to answer common questions about crypto.
Customers can sign up for a Coinbase account here to buy, sell, convert, send, receive, or store FET today.
Please note: Coinbase Ventures may be an investor in the crypto projects mentioned here, and additionally, Coinbase may hold such tokens on its balance sheet for operational purposes. A list of Coinbase Ventures investments is available at https://ventures.coinbase.com/. Coinbase intends to maintain its investment in these entities for the foreseeable future and maintains internal policies that address the timing of permissible disposition of any related digital assets, if applicable. All assets, regardless of whether Coinbase Ventures holds an investor or Coinbase holds for operational purposes, are subject to the same strict review guidelines and review process.
This website contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of Coinbase, Inc., and its affiliates (“Coinbase”), and Coinbase is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. Coinbase is not responsible for webcasting or any other form of transmission received from any Third-Party Site. Coinbase is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by Coinbase of the site or any association with its operators.
Crypto is a new type of asset. Besides potential day to day or hour to hour volatility, each crypto asset has unique features. Make sure you research and understand individual assets before you transact.
All images provided herein are by Coinbase.
Fetch.ai (FET) is now available on Coinbase was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
Starting today, Paxos Standard (PAX) and Polymatch Network (POLY) are available on Coinbase.com and in the Coinbase Android and iOS apps. Coinbase customers can now trade, send, receive, or store PAX and POLY in most Coinbase-supported regions, with certain exceptions indicated in each asset page here. Trading for these assets is also supported on Coinbase Pro.
Paxos Standard (PAX) is a stablecoin fully backed by the US dollar and developed by the Paxos Trust Company. PAX is issued as an Ethereum token and one PAX token represents one US dollar.
Polymath Network (POLY)is an Ethereum protocol that aims to create, issue, and manage digital securities on the blockchain. By creating a compliance-focused standard (ST-20) to issue and manage security tokens, Polymath seeks to tokenize and support the trading of traditional and new classes of assets.
One of the most common requests we hear from customers is to be able to buy and sell more cryptocurrencies on Coinbase. We announced a process for listing assets, designed in part to accelerate the addition of more cryptocurrencies. We are also investing in new tools to help people understand and explore cryptocurrencies. We launched informational asset pages (see PAX and POLY), as well as a new section of the Coinbase website to answer common questions about crypto.
Customers can sign up for a Coinbase account here to buy, sell, convert, send, receive, or store PAX and POLY today.
Please note: Coinbase Ventures may be an investor in the crypto projects mentioned here, and additionally, Coinbase may hold such tokens on its balance sheet for operational purposes. A list of Coinbase Ventures investments is available at https://ventures.coinbase.com/. Coinbase intends to maintain its investment in these entities for the foreseeable future and maintains internal policies that address the timing of permissible disposition of any related digital assets, if applicable. All assets, regardless of whether Coinbase Ventures holds an investor or Coinbase holds for operational purposes, are subject to the same strict review guidelines and review process.
This website contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of Coinbase, Inc., and its affiliates (“Coinbase”), and Coinbase is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. Coinbase is not responsible for webcasting or any other form of transmission received from any Third-Party Site. Coinbase is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by Coinbase of the site or any association with its operators.
Crypto is a new type of asset. Besides potential day to day or hour to hour volatility, each crypto asset has unique features. Make sure you research and understand individual assets before you transact.
All images provided herein are by Coinbase.
Paxos Standard (PAX) and Polymath Network (POLY) are now available on Coinbase was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
The Grayscale Bitcoin Trust (GBTC) is echoing bullish sentiment in Bitcoin (BTC) as its premium over spot price rises to its highest since May.
Data from analytics resource Bybt shows that on July 27, the so-ca Grayscale premium stood at -5.88%. The last time it was closer to zero was on May 25.
GBTC premium slips above -6%
That was a week after Bitcoin began a major price drawdown which this week has finally shown signs of abating.
GBTC has been the subject of intense speculation since Bitcoin’s 55% price dip, with unlocking of GBTC shares allegedly capable of adding to selling pressure.
As Cointelegraph reported, such a premise is false by default, given restrictions in place on GBTC holders.
Nonetheless, interest in purchasing has resurfaced this month in particular, with conspicuous names adding to their tranche and increasing their Bitcoin exposure.
The Grayscale premium — the trading price of GBTC relative to the net asset value (NAV) of its BTC holdings — has increased in step, trending back to zero after an extended stay in negative territory.
With unlockings all but complete, the narrative surrounding Bitcoin price suppression has all but disappeared.
“$GBTC premium has gone from -15% to -5% in 5 days,” trader and analyst Nick Hellman commented on the latest changes.
“If $BTC can maintain these levels and have Grayscale premiums flip positive that will add fuel to this Bitcoin fire.”
GBTC premium chart. Source: Bybt
Purpose Bitcoin ETF holdings hit pre-crash levels
Despite mixed perceptions over GBTC, one figure decidedly not at all bearish on any timeframe is Grayscale CEO, Michael Sonnenshe
In the company’s latest midyear shareholder letter, Sonnenshein reiterated previous public statements about his intent to turn GBTC, along with its altcoin-focused equivalents, into exchange-traded funds (ETFs).
“We are 100% committed to converting Grayscale Bitcoin Trust (symbol: GBTC), Grayscale Ethereum Trust (symbol: ETHE), and our other investment products into ETFs,” the letter reads
With United States yet to approve a single Bitcoin ETF, neighboring Canada, which gave the green light to the first player, the Purpose Bitcoin ETF, has never looked back.
On Tuesday, Purpose’s assets under management jumped from $900 million CAD to $1.1 billion CAD — its highest since May 13.
Purpose Bitcoin ETF assets under management chart. Source: Bybt
By Philip Martin, Chief Security Officer, Coinbase
The recent high profile ransomware attacks on Colonial Pipeline and food processing giant JBS have led to knee jerk calls to ban cryptocurrencies because the attackers demanded to be paid in Bitcoin. But if cryptocurrency went away tomorrow would ransomware end? In a word, no. Ransomware existed before cryptocurrency was popular and, if cryptocurrency was outlawed tomorrow, criminals would simply seek alternative payment methods, of which there are many.
The rise of ransomware has been horrible to behold. It is one of the rare online crimes where the impact is felt broadly by everyone. Hospitals unable to service patients. Local governments unable to support citizens. Workers losing jobs because their employers go bankrupt.
But blaming crypto for ransomware is like holding email accountable for ransomware because that’s a vector criminals use to infect victims. Neither are the cause of ransomware. What we need to eradicate this scourge is a more nuanced, multi-pronged strategy that gets to the root cause of the problem.
Why it’s getting worse
The growth of ransomware can be attributed to the rate at which companies are shifting critical systems online and the poor level of controls many companies have over their IT systems. When you couple those factors with ransomware gangs operating from foreign jurisdictions with relative impunity and little ability for law enforcement to drive an international response, you get a recipe for trouble.
This has led some pundits to throw up their hands and conclude the only way to fight back is to ban cryptocurrencies. But if cryptocurrencies are banned, attackers will simply fall back to traditional money laundering methods like prepaid gift cards, money-mules, bulk cash smuggling, funnel accounts or requiring air-dropped cash payments.
What’s more, there are many reasons cryptocurrency is good for law enforcement. Talk to law enforcement agents and those prosecuting crimes like this and they’ll tell you that cryptocurrencies are much easier to track than traditional, harder to trace forms of payment, such as cash.
In the world of Bitcoin, while you might not be able to immediately attach a name to a transfer, the whole history of transfers, for every address on the cryptocurrency network, is preserved forever and accessible to all. Law enforcement can use these “digital breadcrumbs” to track spending patterns. Where that cryptocurrency touches an exchange like Coinbase, which collects KYC (Know Your Customer) data for customers, a subpoena or a warrant will get them a real-world identity. That stands in stark contrast to traditional money laundering using cash or commodities.
What we should be doing
If banning use of cryptocurrency isn’t the answer, what is?
Increase global law enforcement focus on ransomware and aggressively prosecute criminals — in the US or overseas — to create a real disincentive for criminals to use ransomware. The creation of a Ransomware and Digital Extortion Task Force by the DOJ was a positive step forward, but genuine investment in prosecutorial resources and continued engagement with our international partners will be key in the fight to ensure there are no safe haven countries for criminals.
In the wake of the Enron scandal, Congress created incentives for public companies to clean up financial controls and reporting via the Sarbanes-Oxley Act. Earlier this year Congress passed the Anti-Money Laundering Act, setting a framework for financial institutions to modernize their technology and improve the sharing of information to combat money laundering and terrorist financing. Congress must play a similar role in creating minimum standards for corporate security reporting and transparency, creating accountability for malfeasance and creating safe harbors for cooperation and information sharing among companies.
Ensure common sense, existing regulations are applied evenly so that certain exchanges aren’t allowed to use jurisdictional arbitrage to avoid implementing KYC/AML programs. Research shows that the majority of illicit Bitcoin flows through a small group of exchanges. Law enforcement and regulators could curb the flow of ransomware-proceeds by enforcing existing regulations on these venues.
That will take time, of course, so in the meantime companies in the trenches should actively review their own security posture and figure out if and how they could recover if attacked. Most companies have backup policies, but few organizations have restore policies or regularly test their ability to restore in a real-world scenario.
Ransomware isn’t going away even if cryptocurrencies are banned. So don’t be tempted by the “easy answer” given it isn’t really an answer at all. Let’s take the bull by the horns and focus on the hard work of putting ransomware in its place.
This piece originally appeared in Morning Consult.
Ransomware is a scourge, but eliminating cryptocurrencies won’t make it go away was originally published in The Coinbase Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.
For a very long time Vanuatu, always the most popular offshore licensing jurisdiction for self-regulated FX/CFD operations, disapproved dealing with Cryptocurrencies in all forms for its VFSC licenses, to the extent that if a small reference to crypto was made on the licensee’s website, regardless whether as a means for payment, a traded commodity or a CFD, the license could have been revoked and the 50K$ bond forfeited. Seemingly all of it is about to change.
We sat down with Advocate & Notary Tal Itzhak Ron, Chairman and CEO, and Advocate Genia Gurevitz, Head of Banking and Payments Services, from leading legal and banking firm, Tal Ron, Drihem & Co. to shed some light on what measures are taking effect in Vanuatu this week, and if there is anything groundbreaking about it (Hint: There is, indeed, and Finance Magnates are the first to reveal it!).
Tal explains that as of July 22nd, the amendment to the Financial Dealers Licensing Act, without any preliminary announcement, surprisingly went into effect which allows the “distribution, secondary trading, custodial storage and provision of investment advice or other services in relation to digital assets.” This comes after years that any engagement with cryptocurrencies would be restricted and seen as illegal by the regulators in Vanuatu, making anyone who wished to deal with Crypto go other ways.
Suggested articles
Axia Investments – Take Your Trading to the Next LevelGo to article >>
Tal Ron, Drihem & Co., Law Firm lobbied massively for that change to happen, prepared for the announcement, and built the payments infrastructure 1.5 years in advance to facilitate the needs of those wishing to enrich their services offered and give their business a competitive edge, Genia continues. This amendment placed Vanuatu in the major league, with other, more established, jurisdictions that Tal Ron, Drihem & Co. have already been using since 2017 to represent clients in issuing coins and engage with other blockchain crypto activities, such as Gibraltar, Switzerland, Singapore, Malta, and Estonia. The amendment seeks to expand the possibilities for already-licensed companies in Vanuatu (for which Tal and Genia’s firm are responsible for a large percentage of those), as well as to attract new digital asset companies for which the most important part is to know how to bank them properly and protect their interests while staying fully compliant and socially responsible.
Genia Gurevitz
The novelty about the new legislation is not about brokers being able to use Crypto deposits or trade or offer Crypto for themselves or at their business, which is great in itself, but now they are finally able, if play their card right and found adequate, to open a bank account in exceptional brick-and-mortar banks such as Bank Frick in Liechtenstein, which our firm partners with, Genia explains.
Genia discloses that this type of legislation is similar to what they have already dealt with in the past in Gibraltar, one that effectively allows (or does not prevent) crypto-entrepreneurs to launch their own digital currencies. Therefore, Tal’s team has already gathered the knowledge and infrastructure to facilitate the growing demand for Vanuatu companies from all aspects and built a complex network of payment companies accepting the Vanuatu license, thus allowing companies regulated there to issue coins and collect payments, aside of operating FX sites.
Bitcoin price started a strong upward move above the $35,000 resistance against the US Dollar. BTC is showing positive signs and it could rally further above $40,000.
Bitcoin started a strong increase above the $33,000 and $35,000 resistance levels.
The price is now trading well above $35,000 and the 100 hourly simple moving average.
There is a key bullish trend line forming with support near $35,500 with resistance near $31,250 on the hourly chart of the BTC/USD pair (data feed from Kraken).
The pair could correct gains, but the bulls are likely to remain active near $37,000.
Bitcoin Price Surges above $38,000
Bitcoin price found a strong buying interest near the $32,000 zone. BTC formed a support base near the $32,000 and it started a major upward move.
The price surged above the $32,000 and $35,500 resistance levels. There was a clear break above the $38,000 resistance level. The upward move gained strength and the price even traded close to the $40,000 resistance zone.
A high was formed near $39,721 and the price is now correcting gains. It is trading near the 23.6% Fib retracement level of the recent rally from the $33,904 swing low to $39,723 high. Bitcoin is now trading well above $35,000 and the 100 hourly simple moving average.
There is also a key bullish trend line forming with support near $35,500 with resistance near $31,250 on the hourly chart of the BTC/USD pair. It is showing a lot of positive signs near the $38,000 level. On the upside, an initial resistance is near the $39,000 level.
Source: BTCUSD on TradingView.com
The first major resistance is near the $39,500 level. The main resistance sits near $40,000. A successful break and close above the $40,000 level could initiate a fresh rally in the near term. In the stated case, the price is likely to move towards the $42,500 level in the near term.
Dip Supported in BTC?
If bitcoin fails to climb above the $39,500 and $40,000 resistance levels, it could start a downside correction. An initial support on the downside is near the $37,500 level.
The first major support is now near the $36,800 zone. A clear downside break below the $36,800 support may possibly push the price towards the $36,000 support zone in the near term.
Technical indicators:
Hourly MACD – The MACD is now losing pace in the bullish zone.
Hourly RSI (Relative Strength Index) – The RSI for BTC/USD is now well in the overbought zone.
Major Support Levels – $37,500, followed by $36,800.
Major Resistance Levels – $39,000, $39,500 and $40,000.
The quest to understand the opportunities and challenges of a central bank digital currency, or CBDC, is underway in 81 countries, with five nations fully implementing a digital version of their currency, according to a new tracker from the Atlantic Council.
The Caribbean region is home to all five CBDCs that are currently in use, with The Bahamas, Saint Kitts and Nevis, Antigua and Barbuda, Saint Lucia and Grenada all implementing their digital cash systems.
CBDCs are in their pilot stage in 14 other countries, including South Korea and Sweden, the tracker shows.
Established in 1961, the Atlantic Council describes itself as a nonpartisan organization that seeks to promote U.S. leadership on various world issues. The CBDC tracker, which was unveiled July 22, currently monitors 83 countries and currency unions.
Among the countries with the four largest central banks — United States Federal Reserve, European Central Bank, Bank of Japan and Bank of England — the U.S. is furthest behind in terms of CBDC development.
Related: Reserve Bank of India mulls first steps toward an eventual CBDC
The Federal Reserve has been researching CBDCs for several years now, with Chairman Jerome Powell indicating in January that digital-dollar development is a “very high priority” to combat financial crime. Meanwhile, New York Fed Bank President John Williams believes that the emergence of cryptocurrencies raises challenging questions for central banks.
Related: Fed and Yale researchers lay out 2 regulatory frameworks for stablecoins
China recently indicated that foreign visitors will be allowed to use the digital yuan during the 2022 Winter Olympics — provided they share their passport information with the central bank. A group of U.S. senators that includes Bitcoin proponent (BTC) Cynthia Lummis has urged American Olympians to boycott the digital yuan. According to the South China Morning Post, Beijing responded by telling the U.S. senators to “stop making trouble.”
The People’s Bank of China claims that nearly 21 million people have already opened a virtual wallet for the purpose of using the digital yuan.
A series of attacks compromised several Binance Smart Chain (BSC) projects in May. Following PancakeBunny, its three forks projects — AutoShark, Merlin Labs, and PancakeHunny — were also attacked using similar techniques. PancakeBunny suffered the most costly attack of the four, which saw nearly $45M in total damages. In this article, Dr. Chiachih Wu, Head of the Amber Group Blockchain Security Team, elaborates on the details behind the attacks on the three copycats.
Copycats
AutoShark was attacked five days after PancakeBunny, followed by Merlin Labs and PancakeHunny, respectively. The following is an analysis of the problems and possible attack techniques for these three forked projects.
In the SharkMinter.mintFor() function, the amount of rewarding SHARK tokens to be minted (i.e., mintShark) is derived from sharkBNBAmount computed by tokenToSharkBNB() in line 1494. However, tokenToSharkBNB() references the current balance of flip, which makes it a vulnerable point. One could assume that the amount of tokens received in line 1492 is equal to the amount of the flip balance. Still, a bad actor could manipulate the flip balance simply by sending in some flip tokens right before the getReward() call and indirectly breaking the logic of tokenToSharkBNB().
In the underlying implementation of tokenToSharkBNB() , there’s another attack surface. As shown in the above code snippet, _flipToSharkBNBFlip() removes liquidity from ApeSwap (line 1243) or PantherSwap (line 1262) and converts the LP tokens into SHARK+WBNB. Later on, the generateFlipToken() is invoked to convert SHARK+WBNB into SHARK-BNB LP tokens.
Inside generateFlipToken() , the current SHARK and WBNB balances of SharkMinter (amountADesired, amountBDesired) are used to generated LP tokens and the amount of LP tokens are returned to mintFor() as sharkBNBAmount. Based on that, the bad actor could transfer SHARK+WBNB into SharkMinter to manipulate the amount of SHARK tokens to be minted as well.
The loophole in PancakeHunny is identical to that found in AutoShark, in that the bad actor can manipulate HUNNY reward minting with HUNNY and WBNB tokens.
Compared to AutoShark and PancakeHunny, Merlin Labs’ _getReward() has a more obvious vulnerability.
The code snippet above shows that the performanceFee could be manipulated by the balance of CAKE, which indirectly affects the MERL rewards minting. However, the nonContract modifier gets rid of flash loans.
Even without an exploit contract, the bad actor could still profit through multiple calls.
Reproducing AutoShark Attack
To reproduce the AutoShark hack, we need to first get some SHARK-BNB-LP tokens from PantherSwap. Specifically, we swap 0.5 WBNB into SHARK (line 58) and transfer the rest WBNB with those SHARK tokens into PantherSwap for minting SHARK-BNB-LP tokens (line 64). Later on, we deposit those LP tokens into AutoShark’s StrategyCompoundFLIP contract (line 69) to qualify for rewards. Note that we purposely only deposit half of the LP tokens in line 69.
The second step is to make getReward() go into the SharkMinter contract. In the above code snippet, we know that the reward can be retrieved by the earned() function (line 1658). Besides, 30% of the reward (i.e., performanceFee) should be greater than 1,000 (i.e., DUST) to trigger the SharkMinter.mintFor() in line 1668.
Therefore, in our exploit code, we transfer some LP tokens to the StrategyCompoundFLIP contract in line 76 to bypass the performanceFee > DUST check and trigger the mintFor() call. Since we need a lot of WBNB+SHARK to manipulate SharkMinter, we leverage PantherSwap’s 100k WBNB via a flash-swap call in line 81.
In the flash-swap callback, pancakeCall(), we exchange half of the WBNB into SHARK and send the SHARK with the remaining 50,000 WBNB to the SharkMinter contract to manipulate the reward minting.
The next step is to trigger getReward() when the SharkMinter receives the WBNB+SHARK tokens to mint a large amount of SHARK to the caller.
The last step is to convert SHARK to WBNB, pay the flash loan, and walk away with the remaining WBNB tokens.
In our experiment, the bad actor starts with 1 WBNB. With the help of flash loans, he profits from more than 1,000 WBNB being returned in one transaction.
Reproducing PancakeHunny Attack
The theory behind the PancakeHunny attack is similar to the AutoShark attack. In brief, we need to send a lot of HUNNY+WBNB to HunnyMinter before triggering getReward(). However, the HUNNY token contract has a protection mechanism called antiWhale to prevent large amount transfers. Therefore, flash loans do not work here.
To bypass antiWhale, we create multiple child contracts and initiate multiple CakeFlipVault.deposit() calls via said contracts.
In the above exploit code snippet, the LP tokens gathered in line 116 are divided into 10 parts and transferred to 10 Lib contracts in line 122 followed by Lib.prepare() calls for each of them.
Inside Lib.prepare(), we approve() the CakeFlipVault to spend the LP tokens and invoke CakeFlipVault.deposit() to enable the later getReward() calls for minting rewarding HUNNY tokens.
After preparing 10 Lib contracts, the main contract iterates each of them to: 1) swap WBNB to the maximum allowable amount of HUNNY; 2) transfer WBNB+HUNNY to HunnyMinter; 3) trigger getReward() via lib.trigger(); and 4) swap HUNNY back to WBNB.
In the end, the bad actor with 10 WBNB earns around 200 WBNB from 10 runs of 10 Lib contracts operations.
Reproducing Merlin Labs Attack
As mentioned earlier, Merlin Labs has the noContract modifier to get rid of flash loan attacks. However, we could use a script to trigger the attack with multiple transactions initiated from an EOA (Externally Owned Account) address. The only difference is that someone may front-run the bad actor’s transaction to steal the profits.
Similar to the AutoShark attack, we need to prepare enough LINK and WBNB (line 23), use them to mint WBNB-LINK-LP tokens (line 34), and deposit LP tokens into VaultFlipCake contract (line 38).
The remaining actions are:
Swapping WBNB to CAKE (line 42).
Manipulating MERL minting by sending CAKE to VaultFlipToCake contract (line 50).
Triggering getReward() in line 55 (a large amount of MERL tokens are minted).
Swapping MERL back to WBNB and repeating the above steps multiple times.
As mentioned earlier, if someone front runs step 3 right after step 2, that person could remove a large amount of MERL.
In our experiment, the bad actor starts with 10 WBNB and walks away with around 165 WBNB by repeating the four steps 10 times.
About Amber Group
Amber Group is a leading global crypto finance service provider operating around the world and around the clock with a presence in Hong Kong, Taipei, Seoul, and Vancouver. Founded in 2017, Amber Group services over 500 institutional clients and has cumulatively traded over $500 billion across 100+ electronic exchanges, with over $1.5 billion in assets under management. In 2021, Amber Group raised $100 million in Series B funding and became the latest FinTech unicorn valued at over $1 billion. For more information, please visit www.ambergroup.io.
