Alpha Finance Sandwich Attack - Revision history

Azoundria at 18:06, 4 May 2023

2023-05-04T18:06:12Z

← Older revision		Revision as of 12:06, 4 May 2023
Line 4:		Line 4:
	[[File:Alphafinance.jpg\|thumb\|Alpha Finance]]The Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agreed to compensate those affected users with some Alpha tokens.		[[File:Alphafinance.jpg\|thumb\|Alpha Finance]]The Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agreed to compensate those affected users with some Alpha tokens.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="slowmisthacked-3847" /><ref name="alphafinance-502" /><ref name="alphafinancelabtwitter-4448" /><ref name="alphafinancelabtwitter-4449" /><ref name="alphafinanceblog-4450" /><ref name="googledoc-4451" /><ref name="reddit-4452" /><ref name="ethereumprice-4453" /><ref name="blockthreat-5482" />
	<ref name="slowmisthacked-3847" /><ref name="alphafinance-502" /><ref name="alphafinancelabtwitter-4448" /><ref name="alphafinancelabtwitter-4449" /><ref name="alphafinanceblog-4450" /><ref name="googledoc-4451" /><ref name="reddit-4452" /><ref name="ethereumprice-4453" /><ref name="blockthreat-5482" />

	== About Alpha Finance ==		== About Alpha Finance ==
Line 67:		Line 66:
	!Description		!Description
	\|-		\|-
	\|October 23rd, 2021 ~~12:00:00 AM~~		\|October 23rd, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 75:		Line 74:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 94:		Line 96:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Which policies could have prevented this event from happening?~~

	== References ==		== References ==

Azoundria at 23:56, 27 February 2023

2023-02-27T23:56:48Z

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/alphafinancesandwichattack.php}} Alpha FinanceThe Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agree..."

2023-01-28T03:55:34Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/alphafinancesandwichattack.php}} thumb|Alpha FinanceThe Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agree..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/alphafinancesandwichattack.php}}

[[File:Alphafinance.jpg|thumb|Alpha Finance]]The Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agreed to compensate those affected users with some Alpha tokens.

This is a global/international case not involving a specific country.

== About Alpha Finance ==
"Alpha Finance Lab is a DeFi Lab, and on a mission to build Alpha Universe. Alpha Universe includes the Alpha ecosystem, which consists of Alpha products that interoperate to maximize returns while minimizing risks for users, and other ecosystems incubated through the Alpha Launchpad incubator program."

"A sandwich attack is happening with DeFi protocols and platforms, and are a way of market manipulation. Easily said: The attacker will try to sandwich someones transaction with two of his own transactions, before and after, and therefore making a small loss to the user."

"Let's make an example: A man named Mark wants to buy Bitcoins. He creates a buy order on a decentralised exchange. Let's say he wants to buy 0.1 BTC for $62'000. There is a slippage factor of 0.1% included. During the time where the transaction needs to get confirmed (usually only a few seconds) an attacker sees Marks transaction and recognises whether the price of the currency will go up or down. Now they add their own order and buy right before Marks transaction is confirmed and right after they sell their shares again. So with the slippage factor Marks transaction will get confirmed at a BTC prize of $62’062 due to the attackers pushing the price up."

"These implicit assumptions on Uniswap V2 resulted in 20 addresses on Alpha Homora V2 being impacted and lost a total of 40.93 ETH to miners who extracted this value." "In this case, the implicit assumptions not stated on the Uniswap V2 Router contract resulted in miners successfully extracting values from 20 addresses even though Alpha Homora V2 were audited three times by OpenZeppelin, Quantstamp, and PeckShield."

"We recently received a user report regarding abnormal position value loss in Alpha Homora V2 on Ethereum after the position was opened. Looking at the transaction details, the slippage control values correctly reflected the 1% tolerance, but the LP value still did not conform."

"In short, a Miner Extractable Value (MEV) bot inspected the transaction, bundled the transactions such that the bot could make financial profits, and sent these transactions privately to a particular group of miners who then mined these transactions."

"[T]he Uniswap V2 Router contract has implicit assumptions that are not clearly stated on the contract level. Hence, without stating these assumptions, slippage control for some trades on Uniswap V2 may not be checked and may not be taken into account at all in certain scenarios."

"The issue revolves around the Uniswap V2 Router’s addLiquidity function, which internally calls _addLiquidity." "The function takes 2 amounts: amountXDesired and amountXMin amountXDesired determines the desired amount for adding liquidity to the pool. amountXMin determines the minimum amount of assets used."

"From our investigation, the MEV bots are generalized sandwich attack bots, which are not specific to Alpha Homora V2."

"The fix has been patched." "After we have confirmed and tested the fix, our team proceeded quickly to patch the issue. Extra checks were performed to ensure the pre-conditions are satisfied and such scenarios can no longer happen. The fix has also been confirmed by OpenZeppelin and Peckshield." "The vulnerability was present since the original version of Alpha Homora V2, which has undergone 3 different audits from OpenZeppelin, Peckshield, and Quantstamp. The issue has remained unnoticed until recently, which we had already fixed."

"We have plans to compensate these 20 addresses. However, what’s more important is to share this with our community, especially other builders in the space to be aware of these implicit assumptions that are not stated, how you can detect this as a builder, and how to prevent/mitigate this."

"To uphold the function of Alpha Tokenomics, which serves as an insurance for Alpha products, and the collective moral value we share in our community, 154,671 ALPHA (0.064% of total ALPHA staked) will be extracted from Alpha Tokenomics and be distributed to the relevant users."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Alpha Finance Sandwich Attack
!Date
!Event
!Description
|-
|October 23rd, 2021 12:00:00 AM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $167,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Which policies could have prevented this event from happening?

== References ==
[https://hacked.slowmist.io/en/?c=ETH SlowMist Hacked - SlowMist Zone] (Nov 5)

[https://alphafinance.io/ Alpha Finance Homepage] (May 12)

[https://twitter.com/AlphaFinanceLab/status/1451834669654102017 @AlphaFinanceLab Twitter] (Dec 14)

[https://twitter.com/AlphaFinanceLab/status/1452648896547594246 @AlphaFinanceLab Twitter] (Dec 14)

[https://blog.alphafinance.io/mev-bots-uniswap-implicit-assumptions/ MEV Bots & Uniswap Implicit Assumptions] (Dec 14)

[https://docs.google.com/spreadsheets/d/18mDaQkChTmThLjzRju1RSzhNGq67vHMKFMZC41wVvUE/edit Alpha Homora V2 Ethereum_20 addresses - Google Sheets] (Dec 14)

[https://www.reddit.com/r/CryptoCurrency/comments/qpcl2m/have_you_ever_heard_of_sandwich_attacks_now_you/ Have you ever heard of Sandwich Attacks? Now you have. : CryptoCurrency] (Dec 14)

[https://ethereumprice.org/history/ Ethereum Price History - Table, Charts & CSV – ethereumprice] (Dec 14)

[https://www.blockthreat.io/p/blockthreat-week-42-2021 No Title] (Jan 10)

← Older revision		Revision as of 17:56, 27 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/alphafinancesandwichattack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/alphafinancesandwichattack.php}}
			{{Unattributed Sources}}

	[[File:Alphafinance.jpg\|thumb\|Alpha Finance]]The Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agreed to compensate those affected users with some Alpha tokens.		[[File:Alphafinance.jpg\|thumb\|Alpha Finance]]The Alpha Finance platform enabled users to be "sandwich attacked", where their orders (public on the blockchain) were taken and packaged within other transactions to create profit for the attacker. This was highly lucrative, creating a net profit of over 40 Ethereum for the attacker. The Alpha Finance platform has agreed to compensate those affected users with some Alpha tokens.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="slowmisthacked-3847" /><ref name="alphafinance-502" /><ref name="alphafinancelabtwitter-4448" /><ref name="alphafinancelabtwitter-4449" /><ref name="alphafinanceblog-4450" /><ref name="googledoc-4451" /><ref name="reddit-4452" /><ref name="ethereumprice-4453" /><ref name="blockthreat-5482" />

	== About Alpha Finance ==		== About Alpha Finance ==
Line 97:		Line 99:

	== References ==		== References ==
	[https://hacked.slowmist.io/en/?c=ETH SlowMist Hacked - SlowMist Zone] (Nov 5)		<references><ref name="slowmisthacked-3847">[https://hacked.slowmist.io/en/?c=ETH SlowMist Hacked - SlowMist Zone] (Nov 6, 2021)</ref>

	[https://alphafinance.io/ Alpha Finance Homepage] (May 12)		<ref name="alphafinance-502">[https://alphafinance.io/ Alpha Finance Homepage] (May 13, 2021)</ref>

	[https://twitter.com/AlphaFinanceLab/status/1451834669654102017 @AlphaFinanceLab Twitter] (Dec 14)		<ref name="alphafinancelabtwitter-4448">[https://twitter.com/AlphaFinanceLab/status/1451834669654102017 @AlphaFinanceLab Twitter] (Dec 15, 2021)</ref>

	[https://twitter.com/AlphaFinanceLab/status/1452648896547594246 @AlphaFinanceLab Twitter] (Dec 14)		<ref name="alphafinancelabtwitter-4449">[https://twitter.com/AlphaFinanceLab/status/1452648896547594246 @AlphaFinanceLab Twitter] (Dec 15, 2021)</ref>

	[https://blog.alphafinance.io/mev-bots-uniswap-implicit-assumptions/ MEV Bots & Uniswap Implicit Assumptions] (Dec 14)		<ref name="alphafinanceblog-4450">[https://blog.alphafinance.io/mev-bots-uniswap-implicit-assumptions/ MEV Bots & Uniswap Implicit Assumptions] (Dec 15, 2021)</ref>

	[https://docs.google.com/spreadsheets/d/18mDaQkChTmThLjzRju1RSzhNGq67vHMKFMZC41wVvUE/edit Alpha Homora V2 Ethereum_20 addresses - Google Sheets] (Dec 14)		<ref name="googledoc-4451">[https://docs.google.com/spreadsheets/d/18mDaQkChTmThLjzRju1RSzhNGq67vHMKFMZC41wVvUE/edit Alpha Homora V2 Ethereum_20 addresses - Google Sheets] (Dec 15, 2021)</ref>

	[https://www.reddit.com/r/CryptoCurrency/comments/qpcl2m/have_you_ever_heard_of_sandwich_attacks_now_you/ Have you ever heard of Sandwich Attacks? Now you have. : CryptoCurrency] (Dec 14)		<ref name="reddit-4452">[https://www.reddit.com/r/CryptoCurrency/comments/qpcl2m/have_you_ever_heard_of_sandwich_attacks_now_you/ Have you ever heard of Sandwich Attacks? Now you have. : CryptoCurrency] (Dec 15, 2021)</ref>

	[https://ethereumprice.org/history/ Ethereum Price History - Table, Charts & CSV – ethereumprice] (Dec 14)		<ref name="ethereumprice-4453">[https://ethereumprice.org/history/ Ethereum Price History - Table, Charts & CSV – ethereumprice] (Dec 15, 2021)</ref>

	[https://www.blockthreat.io/p/blockthreat-week-42-2021 No Title] (Jan 10)		<ref name="blockthreat-5482">[https://www.blockthreat.io/p/blockthreat-week-42-2021 No Title] (Jan 10, 2022)</ref></references>