RAMSES EXCHANGE

DESCRIPTION OF EVENTS

"Welcome to Ramses Exchange. Swap tokens, provide liquidity, vote, and more."

"Ramses is a next-generation AMM designed to serve as Arbitrum's central liquidity hub, combining the secure and battle-tested superiority of Uniswap v3 with a custom incentive engine, vote-lock governance model, and streamlined user experience.

RAMSES places a strong emphasis on fostering a vibrant and engaged ecosystem. As part of this commitment, RAMSES will launch with a focus on providing veNFTs to top protocols on Arbitrum. These veNFTs empower protocols to actively manage their positions in a way that aligns with the best interests of their platforms.

RAMSES is dedicated to achieving a high level of decentralization while ensuring the platform remains functional and efficient. To strike this balance, RAMSES establishes a council comprising trusted entities from the broader community. This council is responsible for making decisions in emergency situations, ensuring the platform's integrity and security are upheld.

RAMSES incorporates some of the most advanced features implemented in existing DEXes. These features have been widely recognized and adopted by many users. RAMSES aims to provide a seamless and user-friendly experience while leveraging the innovative capabilities and underlying value it brings to the market.

By these core tenets, RAMSES seeks to bring forth a DEX that not only aligns with the original vision of Solidly but also introduces novel functionalities and prioritizes the needs of the community."

"On October 24th, 2024, the Ramses Exchange (@RamsesExchange) on Arbitrum suffered a loss of nearly $93,000 due to a flaw in its reward distribution logic. The vulnerability allowed the attacker to repeatedly claim rewards across multiple tokenIds without a corresponding reduction in the total rewards supply. By depositing tokens and invoking getPeriodReward() with different NFTs, the attacker drained reward pools, exploiting the contract’s failure to adequately track reward limits per period. The exploit primarily targeted accumulated incentives and fees rather than the underlying liquidity provider funds."

"The root cause is that the FeeDistributor contract did not decrease tokenTotalSupplyByPeriod after each reward claim, resulting in an inflated total reward supply. This oversight allowed repeated reward calculations from the same supply, leading to excess distributions."

Ramses Exchange is an online decentralized exchange platform which allows swapping between pools, contributing liquidity, or voting in their decentralized governance. On October 23rd, an error in their reward distribution logic was exploited to gain an attacker $93k. Multiple third parties published analyses of the exploit. It does not appear that the Ramses Exchange team has publicly acknowledged the attack, while they appear to have already been running a competitive audit competition. It is unclear whether the attack will have any effect on platform users.

Arbitrum One Transaction Hash (Txhash) Details | Arbitrum One  (Nov 15)
R A M S E S (Nov 15)
What is RAMSES? | RAMSES (Nov 15)
Ramses Exchange Hack Analysis. Overview: | by Shashank | Oct, 2024 | SolidityScan (Nov 15)
Ramses V3 | Consensys Diligence (Nov 15)
Unraveling The 90k Mystery Inside Ramses Exchanges Reward Exploit (Nov 15)
@code4rena Twitter (Nov 15)
@RamsesExchange Twitter (Nov 15)
@RamsesExchange Twitter (Nov 15)

More case studies

SHARPEI Dispute About Public
Figure Endorsement Rug Pull

Cryptobottle Disabled Swap
Balance Check Vulnerability