Knowledge pays. Take a look at the latest hack of Balancer, a defi exchange which bases itself on user created exchange pools.

The hacker used a loan of some $23 million in ETH (wait, who the fuck loans that much ETH and how and why? I’ve got a hundred questions already) from dYdX. They then proceeded to exploit balancer based on a bug around deflationary tokens.

They targeted a pool for STA and WETH. STA, a deflationary token, was reduced to a tiny fraction of an amount. With the amount of STA being just a fraction (0.000000000000000001 STA). STA has a 1% transfer fee, with functions of  transfer() and transferFrom() in its code. So trading it all against WETH resulted in an increasingly less amount of STA each time. The result was the tiny fraction of STA.

They could then proceed to trade that amount against other sums. But, that 1% transfer fee remained. But there was no more STA. So instead, the fee drained pools of WETH instead, into the attacker’s wallet. They repeated this for BTC and LINK and others.

This wasn’t even the last of it! After repaying the loan and running with their funds (swapped for a fraction of an amount of STA), they then went to Uniswap and made even more money.

The attacker clearly had a high-level knowledge of solidity and smart contracts. It’s obvious they are an engineer, and they’re $500,000 richer because of it.

As reported by 1INCH, the hacker made off with:

• 455 WETH ($100k worth)
• 2.4m STA ($100k worth) and converted it to 109 WETH ($25k worth)
• 11.36 WBTC ($100k worth)
• 60.9k SNX ($100k worth)
• 22.6k LINK ($100k worth)

Lesson here? New defi beta protocols are dangerous. Balancer didn’t do its homework. The attacker did.

So do your homework, kids!