PREDY FINANCE

DESCRIPTION OF EVENTS

"ZERO GAS EXPERIENCE PERP AND SWAP DEX New Trade experience with the Intent-Based Perpetual and Swap DEX. Maximise your profit and minimise your loss."

"Intent-based architecture has realised to smash the gas fee away." "To maximise your profit effectively, leverage upto x50 available." "Exact, specific and safe orders for your positions."

"Experience seamless token swaps like never before with our revolutionary platform, where every swaps is not just smooth but also gas fee-free. Say goodbye to costly transaction fees and hello to effortless trading. Unlock a world of convenience and savings in the exciting realm of decentralized finance."

"Step into the world of perpetual trading where opportunities are limitless. Harness the power of leverages and set your own terms with limit orders, enabling you to amplify your gains while managing risk effectively. Join us today and explore a dynamic landscape where every trade holds the potential for unprecedented growth and success."

"Predy is a mechanism that allows efficient on-chain trading of delta and gamma. It enables perpetual futures and Squart (to be explained later) trading for all pairs that exist on Uniswap. There is no need to specifically provide liquidity for perps and options; having a Uniswap pool is sufficient.

Predy consists of a lending pool called PredyPool and market contracts such as PerpMarket and GammaMarket. By creating new market contracts, new exchanges can be defined. The lending pool, being a place where funds are concentrated, is a highly targeted spot, and it is impractical to redevelop the lending pool repeatedly. Therefore, the design allows for defining orders and products by adding new market contracts without making changes to the lending pool.

Squart (Square Root of Perpetual) is a perpetual future that tracks the square root of the price. Unlike standard options or perpetual options, Squart does not have a strike price. However, similar to options, it carries gamma exposure. This feature helps address the issue of liquidity fragmentation in gamma trading. Additionally, Squart is fully backed by the LP positions in Uniswap V3 Pools."

"The attacker deployed a contract for the attack. This was deployed on Mar-29–2024. All subsequent steps were executed from this Attacker Contract."

"Predy Pool manages the liquidity of currencies. This is used to apply leverage when creating positions in Predy. Anyone can add new currency pairs. Before the attack, Predy had the following two pairs:

pair id 1 : pair of Bridged USDC and Wrapped ETH pair id 2 : pair of Native USDC and Wrapped ETH The Attacker Contract created a new pair, pair id 3. This is a pair of Native USDC and Wrapped ETH, similar to pair id 2.

pair id 3: pair of Native USDC and Wrapped ETH

In Predy, creating the same pair is not an issue by design. However, the pair creator can restrict the contracts that trade with the pair. Therefore, the Attacker Contract does not have the authority to trade with existing pairs. Below is the line that restricts trading authority."

"Thus, the Attacker Contract created a new pair. nAt this stage, the Attacker Contract only created the new pair and did not provide funds."

"In the newly created pair id 3, the Attacker Contract has the authority, so the trade function can be executed. The Attacker Contract calls the trade function specifying pair id 3 of Predy Pool. Within this, `TradeLogic.trade` is called, and then `TradeLogic.callTradeAfterCallback` is called. And within this, `AttackerContract.predyTradeAfterCallback` is called.

This was implemented to call the predyTradeAfterCallback of Predy’s MarketContract. A mutex is used for the trade function call, so the trade function cannot be called again within the predyTradeAfterCallback function."

"However, here the take function can be called to obtain liquidity from Predy Pool or the supply function to provide liquidity. This is necessary to utilize liquidity within the trade function."

"Within the predyTradeAfterCallback of the Attacker Contract, When the `PredyPool.take` function is called specifying the amount of USDC in Predy Pool, this amount is transferred to the Attacker Contract. This amount is the same as the amount existing in pair id 2. The Attacker Contract then calls `PredyPool.supply`, supplying the amount of USDC obtained by the take function to pair id 3. The same was done for Wrapped ETH.

Finally, a difference check is performed before and after the trade process within the Pool."

"Since the assets in the Pool simply moved from pair id 2 to pair id 3, there is no difference in the amounts within the pool. Therefore, the trade function call from the Attacker Contract was judged as a normal transaction."

"The state where the Attacker Contract has supplied funds to pair id 3 remains in Predy Pool. The Attacker Contract executed the withdraw function and obtained funds from the created pair.

The funds withdrawn in this manner are 219,585.737814 USDC and 83.9 WETH."

"This issue was caused by the unintended use of a callback, which we could not discover before deployment. We have already stopped the Contract, so there will be no further damage. Countermeasures are already under consideration, and we will ensure a secure state to provide it to everyone safely. Resuming operations are considered at an appropriate time after undergoing an audit. updates will be provided as soon as details are finalized."

"The funds withdrawn in this manner are 219,585.737814 USDC and 83.9 WETH."

"We would like to remark that we do appreciate everyone, including Twitter (X) and Discord, who shared various opinions on this Attack, especially @HypernativeLabs. Thank you so much for all your support"

Predy Finance offers a new decentralized exchange experience with minimal trading fees, and also features a lending pool. A vulnerability existed where a callback to a malicious contract could bypass certain checks designed to prevent funds being drained. The funds were drained by exploiting this vulnerability. The contract was patched and the smart contract is working on an audit.

@SlowMist_Team Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
Ethereum Transaction Hash (Txhash) Details | Etherscan  (Jun 5)
Arbitrum Transaction Hash (Txhash) Details | Arbiscan  (Jun 5)
Arbitrum Transaction Hash (Txhash) Details | Arbiscan  (Jun 5)
Predy Finance | Perp and Swap DEX (Jun 5)
Welcome to Predy V6 | Predy V6 (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
Postmortem Report on The Details of The Events of May 14 2024 (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)
@predyfinance Twitter (Jun 5)

More case studies

Equalizer Exchange
Domain Hijacking

Alex Lab Private
Key Compromise