Biswap's liquidity pools were exploited by a vulnerability in the "Biswap migration contract" allowing anyone to replace legitimate migration transactions with fake ones.

$710,251 was stolen in this attack, including the value of the LP tokens and the BSW tokens that the attacker minted for free.

This is how it happened (Refer to the visual below):   Step 1: The attacker initiates the Biswap Migrator contract's "migration function" using real pairs and fake tokens.

• This function, designed to migrate user LP assets from one pool to another, doesn't validate token and pair parameters.
• The attacker leverages this loophole to burn user LP assets and create their own LP pool using fake tokens. As a result, the user assets get stuck in the contract.
• This happens with several pools, including BSW-BUSD, BSW-BNB, and BSW-USDT. Note: The token0 and token1 mentioned above are specific identifiers for the fake tokens the attacker used.

 Step 2: The attacker then uses real token0 and token1 along with the fake LP created in step one to run the "migration function" again—this time adding the remaining contract assets to their LP, substituting the user LP assets with their fraudulent ones. This clever misdirection funnels the user's funds into the attacker's LP pool.   As for the impacted pools:  

• BSW-BUSD: The attacker burned $71,000 in LP tokens, created a fake pool using token0 and token1, added $71,000 in contract assets to their fake pool, and then replaced user LP assets with fake ones. They subsequently withdrew a total of $142,000 in $BSW and $BUSD from the fake pool.
• BSW-BNB: A similar modus operandi, but with $67,000 burned in LP tokens. After creating the fake pool and adding the contract assets, they withdrew $134,000 in BSW and $BNB.
• BSW-USDT: Again, the attacker burned $66,000 in LP tokens, added the same amount to the fake pool, replaced the user's LP assets, and withdrew $132,000 in BSW and $USDT.

  The attacker transferred some of the stolen funds to other addresses, making it harder to track them.    

Biswap has stated that they have fixed the vulnerability and ensured the safety of user funds.

This unfortunate instance demonstrates the potential vulnerabilities when parameters are not adequately validated in smart contracts.

Thank you for reading through, and follow me here and on Twitter for more regular post updates.

I’d also appreciate it if you shared this with your friends, who would enjoy reading this.

You can find my other research & investment thesis here: https://bit.ly/3CjMvoA

If you find this analysis useful, please consider donating to 0xd95d4b14dcfa941bf916255b3624c0bfb22166c8.

Thank you.