Fantasm Finance Contract Vulnerabilities: Difference between revisions

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search
No edit summary
(Another 30 minutes complete. Prevention added. Information relocated around.)
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/fantasmfinancecontractvulnerabilities.php}}
{{Case Study Under Construction}}{{Unattributed Sources}}
{{Unattributed Sources}}


[[File:Fantasmfinance.jpg|thumb|Fantasm Finance]]Fantasm Finance is a protocol creating a synthetic token which is 1:1 pegged against the Fantom token. Due to a missing condition check for the minimum amount of fantom, the smart contract hot wallet was vulnerable. A malicious user exploited this and made off with over 1,007 ETH from the hot wallet. Some remaining funds were whitehacked by the protocol team, and dietributed to users. While the hacker has been made an offer, and there is some suspicion of who they are, no offer to return the funds appears to be on the table, nor has the Fantasm team come forward, so it appears that affected users bear the full impact of the breach.
[[File:Fantasmfinance.jpg|thumb|Fantasm Finance]]Fantasm Finance is a protocol creating a synthetic token which is 1:1 pegged against the Fantom token. Due to a missing condition check for the minimum amount of fantom, the smart contract hot wallet was vulnerable. A malicious user exploited this and made off with over 1,007 ETH from the hot wallet. Some remaining funds were whitehacked by the protocol team, and distributed to users. While the hacker has been made an offer, and there is some suspicion of who they are, no offer to return the funds appears to be on the table, nor has the Fantasm team come forward, so it appears that affected users bear the full impact of the breach.


This is a global/international case not involving a specific country.<ref name="slowmist-2069" /><ref name="coinmarketcap-4651" /><ref name="fantasmfinance-7235" /><ref name="fantasmfinance-7236" /><ref name="fantasmfinancetwitter-7237" /><ref name="fantasmfinancetwitter-7238" /><ref name="fantasmfinance-7239" /><ref name="fantasmfinancetwitter-7240" /><ref name="fantasmfinancetwitter-7241" /><ref name="fantasmfinancetwitter-7242" /><ref name="fantasmfinancetwitter-7243" /><ref name="ftmscan-7244" /><ref name="fantasmfinancemedium-7245" /><ref name="fantasmfinancemedium-7246" /><ref name="fantasmfinancemedium-7247" /><ref name="bscscan-7248" /><ref name="bscscan-7249" /><ref name="bscscan-7250" /><ref name="bscscan-7251" /><ref name="ftmscan-7252" /><ref name="ftmscan-7253" /><ref name="ftmscan-7254" /><ref name="ftmscan-7255" /><ref name="etherscan-7256" /><ref name="beincrypto-7257" /><ref name="peckshieldalerttwitter-7258" /><ref name="nipunpittwitter-7259" /><ref name="utoday-7260" /><ref name="quillhashmedium-7261" /><ref name="ftmscan-7333" />
This is a global/international case not involving a specific country.<ref name="slowmist-2069" /><ref name="etherscan-7256" /><ref name="beincrypto-7257" /><ref name="peckshieldalerttwitter-7258" /><ref name="nipunpittwitter-7259" /><ref name="utoday-7260" />


== About Fantasm Finance ==
== About Fantasm Finance ==
<ref name="fantasmfinance-7235" /><ref name="fantasmfinance-7236" /><ref name="fantasmfinance-7239" /><ref name="fantasmfinancemedium-7245" /><ref name="fantasmfinancemedium-7246" />
"Dear Fantomians, we’re excited to announce the launch of Fantasm Finance!" "Welcome to Fantasm. Fractional-Algorithmic Synthetic Token pegged to the value of 1 FTM on Fantom Opera."
"Dear Fantomians, we’re excited to announce the launch of Fantasm Finance!" "Welcome to Fantasm. Fractional-Algorithmic Synthetic Token pegged to the value of 1 FTM on Fantom Opera."


Line 15: Line 16:
"xFTM is a synthetic token pegged to the price of the FTM cryptocurrency on the Fantom Network. It is a fractional-algorithmic synthetic token pegged 1:1 to the dollar value of 1 FTM. In other words, the price of 1 xFTM equals 1 FTM."
"xFTM is a synthetic token pegged to the price of the FTM cryptocurrency on the Fantom Network. It is a fractional-algorithmic synthetic token pegged 1:1 to the dollar value of 1 FTM. In other words, the price of 1 xFTM equals 1 FTM."


TBD - Expand about section - see the template.
== The Reality ==
== What Happened ==
"On March 09, starting at approximately 02:00 p.m. UTC, suspicious transactions related to the Fantasm protocol which resulted in a loss of $2.62M."
"On March 09, starting at approximately 02:00 p.m. UTC, suspicious transactions related to the Fantasm protocol which resulted in a loss of $2.62M."
{| class="wikitable"
|+Key Event Timeline - Fantasm Finance Contract Vulnerabilities
!Date
!Event
!Description
|-
|March 9th, 2022 6:34:12 AM MST
|Funds Transferred From Tornado Cash
|The attacker transfers BNB from the Tornado Cash protocol in two transactions<ref name="bscscan-7248" /><ref name="bscscan-7249" /><ref name="fantasmfinancemedium-7247" />.
|-
|March 9th, 2022 6:36:06 AM MST
|Swapping BNB To USDC
|The attacker swaps their BNB to the USDC stablecoin<ref name="fantasmfinancemedium-7247" /><ref name="bscscan-7250" />.
|-
|March 9th, 2022 6:39:21 AM MST
|USDC Bridged To Fantom Network
|The attacker uses the Celer Bridge to bring their USDC onto the Fantom network<ref name="fantasmfinancemedium-7247" /><ref name="bscscan-7251" />. They ultimately receive their USDC<ref name="ftmscan-7252" />.
|-
|March 9th, 2022 6:46:57 AM MST
|Attacker Obtaining FTM
|The attacker obtains more FTM via a faucet and a swap from USDC<ref name="ftmscan-7253" /><ref name="ftmscan-7254" /><ref name="fantasmfinancemedium-7247" />.
|-
|March 9th, 2022 6:49:26 AM MST
|Exploit Contract Deployed
|The attacker deploys an exploit contract<ref name="fantasmfinancemedium-7247" /><ref name="ftmscan-7255" /><ref>[https://ftmscan.com/tx/0xba31af6843c3b54515a49d8e0fe5c133922508eedb00963ee25e7a3cd7f710ec Exploit Contract Creation - FtmScan] (Apr 25, 2023)</ref>.
|-
|March 9th, 2022 7:42:00 AM MST
|Urgent Announcement on Twitter
|Fantasm Finance posts an urgent announcement on Twitter, recommending that all users redeem their XFTM. There is still a 1,820,012 FTM pool balance remaining at this time<ref name="fantasmfinancetwitter-7243" />. The exploiter address is provided<ref name="ftmscan-7244" />.
|-
|March 9th, 2022 8:11:00 AM MST
|Exit From Liquidity Pools
|Fantasm Finance recommends that users exit from their liquidity pools<ref name="fantasmfinancetwitter-7242" />.
|-
|March 9th, 2022 8:18:00 AM MST
|Some Collateral Whitehacked
|Fantasm Finance posts to Twitter to announce that some of the FTM collateral reserve was whitehacked<ref name="fantasmfinancetwitter-7241" />.
|-
|March 9th, 2022 8:20:36 AM MST
|Fantasm Finance Exploited
|Exploit transaction on the blockchain<ref name="ftmscan-7333" />.
|-
|March 9th, 2022 8:52:00 AM MST
|Twitter Apology Announcement
|Fantasm Finance posts an announcement/apology on their Twitter, acknowledging the exploit and that they are still investigating it further<ref name="fantasmfinancetwitter-7240" />.
|-
|March 10th, 2022 6:22:00 AM MST
|Post-Mortem Published
|Fantasm Finance publishes their post-mortem on the incident<ref name="fantasmfinancemedium-7247" />. This is shared on their Twitter<ref name="fantasmfinancetwitter-7237" />. TBD more Twitter review. TBD review post-mortem and add in more timeline.
|-
|March 11th, 2022 10:03:23 PM MST
|QuillAudits Summary Included
|QuillAudits reports that Fantasm Finance, an algorithmic trading platform operating on the Fantom network, experienced an exploitation incident. The hacker managed to convert the platform's profits, amounting to $2.73 million (1,007 ETH), into ETH and redirected the funds through Tornado Cash<ref name="quillhashmedium-7261" />.
|-
|March 16th, 2022 5:54:00 AM MDT
|WhiteHack FTM Distribution
|Fantasm Finance announces that they will be distributing 935k of  whitehacked Fantom tokens to affected users<ref name="fantasmfinancetwitter-7238" />. TBD more review.
|}
== Technical Details ==
"On March 09, starting at approximately 02:00 p.m. UTC, suspicious transactions related to the Fantasm protocol which resulted in a loss of $2.62M."
<ref name="ftmscan-7333" />


"The Exploiter [got] funds from BNB Chain via Tornado Cash", swapped "BNB to USDC via Pancakeswap", and "USDC to Fantom via Celer Bridge". "The Exploiter receive[d] USDC from Celer Bridge" and "FTM from a faucet". They then "Swap[ped] USDC for more FTM" and "deploy[ed] a contract [to] trigger the exploit".
"The Exploiter [got] funds from BNB Chain via Tornado Cash", swapped "BNB to USDC via Pancakeswap", and "USDC to Fantom via Celer Bridge". "The Exploiter receive[d] USDC from Celer Bridge" and "FTM from a faucet". They then "Swap[ped] USDC for more FTM" and "deploy[ed] a contract [to] trigger the exploit".
Line 22: Line 91:


"After exploiting the vulnerability, the hacker exchanged all the profits for ETH, and used Tornado.cash to mix coins across the chain to the Ethereum main network. According to statistics, the hacker made a profit of 1,007 ETH (about 2.73 million US dollars)." "Eventually, the exploiter sold all his FTM for ETH and bridged these ETH to Ethereum, again via Celer Bridge. The total amount exploited is 1008.498875252390151 ETH (approximately $2,622,097)"
"After exploiting the vulnerability, the hacker exchanged all the profits for ETH, and used Tornado.cash to mix coins across the chain to the Ethereum main network. According to statistics, the hacker made a profit of 1,007 ETH (about 2.73 million US dollars)." "Eventually, the exploiter sold all his FTM for ETH and bridged these ETH to Ethereum, again via Celer Bridge. The total amount exploited is 1008.498875252390151 ETH (approximately $2,622,097)"
== Total Amount Lost ==
The total amount lost has been estimated at $2,626,000 USD.
<ref name="coinmarketcap-4651" />
Exploiter address: <ref name="ftmscan-7244" /> TBD follow this address.
52,844.411560322146244187 FTM transfered on March 9th, 2022.
== Immediate Reactions ==


"Fantom’s on-chain synthetic asset protocol, Fantasm Finance, posted on social media that its FTM collateral reserves had been exploited, and called on users to exchange their XFTM immediately."
"Fantom’s on-chain synthetic asset protocol, Fantasm Finance, posted on social media that its FTM collateral reserves had been exploited, and called on users to exchange their XFTM immediately."
Line 31: Line 112:
"[W]e apologize for the exploit event which just happened. A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now. Most sincere apologies once again."
"[W]e apologize for the exploit event which just happened. A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now. Most sincere apologies once again."


Fantasm Finance "performed a forensics analysis to provide more insight into transactions and actions taken by the exploiter."
=== Fantasm Finance Twitter Announcement ===
Fantasm Finance initially posted a couple of urgent announcements and recommendations<ref name="fantasmfinancetwitter-7243" /><ref name="fantasmfinancetwitter-7242" />.<blockquote>URGENT ANNOUNCEMENT : Redeem your XFTM
 
Our FTM collateral reserve has been exploited, there is still 1,820,012 FTM pool balance remaining currently for redemption.


"We have patched the vulnerability and shared the newly committed code with our auditor."
Exploiter address:


"[W]e have 935,415 FTM from white hacking the protocol ourselves once we became aware of the exploit. We will return this to users via a snapshot compensation at block height 32970600. This part will be returned to XFTM holders." "935k whitehacked FTM will be evenly distributed on Friday 18th to all XFTM holders during the snapshot. Under the Compensation Tab you can see your XFTM & FSM holdings at snapshot. There were around 4.9m XFTM at that time."
<nowiki>https://ftmscan.com/address/0x47091e015b294b935babda2d28ad44e3ab07ae8d#tokentxns</nowiki>


"We once again deeply apologize for the inconveniences caused by this. We encourage the attacker to reach out to the Fantasm team and begin a dialogue for the return of our users’ funds. They are impacting everyday users of DeFi and we would like them to do the right thing. We will honor a bug bounty of 10% upon returning of funds."
We are looking into this right now, more details to follow immediately


This is a global/international case not involving a specific country.
Please also exit from liquidity pools.</blockquote>They later followed this up with an announcement/apology on their Twitter<ref name="fantasmfinancetwitter-7240" />.<blockquote>Dear Community,


The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
we apologize for the exploit event which just happened.


Include:
A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now.


* Known history of when and how the service was started.
Most sincere apologies once again.</blockquote>
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.


Don't Include:
== Ultimate Outcome ==
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.


== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:


* When the service was actually started (if different than the "official story").
Fantasm Finance "performed a forensics analysis to provide more insight into transactions and actions taken by the exploiter."
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.


== What Happened ==
"We have patched the vulnerability and shared the newly committed code with our auditor."
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Fantasm Finance Contract Vulnerabilities
!Date
!Event
!Description
|-
|March 9th, 2022 8:20:36 AM MST
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}


== Total Amount Lost ==
"[W]e have 935,415 FTM from white hacking the protocol ourselves once we became aware of the exploit. We will return this to users via a snapshot compensation at block height 32970600. This part will be returned to XFTM holders." "935k whitehacked FTM will be evenly distributed on Friday 18th to all XFTM holders during the snapshot. Under the Compensation Tab you can see your XFTM & FSM holdings at snapshot. There were around 4.9m XFTM at that time."
The total amount lost has been estimated at $2,626,000 USD.


How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
"We once again deeply apologize for the inconveniences caused by this. We encourage the attacker to reach out to the Fantasm team and begin a dialogue for the return of our users’ funds. They are impacting everyday users of DeFi and we would like them to do the right thing. We will honor a bug bounty of 10% upon returning of funds."


== Immediate Reactions ==
=== Fantasm Finance Post-Mortem ===
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
Fantasm Finance ultimately publishes a post-mortem on the incident<ref name="fantasmfinancemedium-7247" /><ref name="fantasmfinancetwitter-7237" />.<blockquote>Dear Fantasm Community and Partners, we would first and again like to sincerely apologize for the exploit which occurred yesterday. We also want to thank everyone who has helped us in handling this event and supported us in fixing the code vulnerability. We have patched the vulnerability and shared the newly committed code with our auditor.</blockquote>Third Party Reports


== Ultimate Outcome ==
<ref name="quillhashmedium-7261" />
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?


== Total Amount Recovered ==
== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.
There do not appear to have been any funds recovered in this case.


What funds were recovered? What funds were reimbursed for those affected users?
Fantams finance distributed whitehacked funds<ref name="fantasmfinancetwitter-7238" />.


== Ongoing Developments ==
== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
TBD
== Individual Prevention Policies ==
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}
The Fantasm Finance smart contract had limited smart contract validation performed by a single smart contract auditing firm. This failed to catch the missing condition check. Users should not have trusted their funds to a platform with only a single validation.
 
{{Prevention:Individuals:Safe Smart Contract Usage}}
 
{{Prevention:Individuals:Store Funds Offline}}


{{Prevention:Individuals:End}}
{{Prevention:Individuals:End}}


== Platform Prevention Policies ==
== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}
This could have been prevented through further audits or storing funds in a multi-signature wallet. An industry insurance fund can assist affected users.
 
{{Prevention:Platforms:End}}


== Regulatory Prevention Policies ==
=== Further Smart Contract Auditing ===
{{Prevention:Regulators:Placeholder}}
Having two audits completed prior to launch, and a third audit after 3 months would have greatly decreased the chance the missing validation went unnoticed.


{{Prevention:Regulators:End}}
{{Prevention:Platforms:Regular Audit Procedures}}


== References ==
=== Implement Multi-Signature Wallet ===
<references><ref name="slowmist-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
As an alternative, having the majority of funds inaccessible to the normal functions of the smart contract would prevent their theft. Instead, these funds could be made available through a multi-signature wallet requiring a signed transaction from multiple individuals. This would limit the theft to only those funds in the hot wallet.


<ref name="coinmarketcap-4651">[https://coinmarketcap.com/currencies/ethereum/historical-data/ https://coinmarketcap.com/currencies/ethereum/historical-data/] (Dec 21, 2021)</ref>
{{Prevention:Platforms:Implement Multi-Signature}}


<ref name="fantasmfinance-7235">[https://fantasm.finance/ Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera] (Mar 16, 2022)</ref>
=== Establish Industry Insurance Fund ===
The industry insurance fund can provide an additional treasury and resources in the event of a failure to secure the system, while also establishing validators to help ensure the situation in the first place.


<ref name="fantasmfinance-7236">[https://fantasm-finance.gitbook.io/fantasm/ About Fantasm Finance - Fantasm] (Mar 16, 2022)</ref>
{{Prevention:Platforms:Establish Industry Insurance Fund}}


<ref name="fantasmfinancetwitter-7237">[https://twitter.com/fantasm_finance/status/1501911312510685187 @fantasm_finance Twitter] (Mar 16, 2022)</ref>
{{Prevention:Platforms:End}}


<ref name="fantasmfinancetwitter-7238">[https://twitter.com/fantasm_finance/status/1504063662679543810 @fantasm_finance Twitter] (Mar 16, 2022)</ref>
== Regulatory Prevention Policies ==
This could have been prevented through further audits or storing funds in a multi-signature wallet. An industry insurance fund can assist affected users.


<ref name="fantasmfinance-7239">[https://fantasm.finance/compensation Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera] (Mar 16, 2022)</ref>
=== Further Smart Contract Auditing ===
Having two audits completed prior to launch, and a third audit after 3 months would have greatly decreased the chance the missing validation went unnoticed. In addition, third parties may be able to suggest more secure fund storage structures such as a multi-signature treasury.


<ref name="fantasmfinancetwitter-7240">[https://twitter.com/fantasm_finance/status/1501586619928924160 @fantasm_finance Twitter] (Mar 16, 2022)</ref>
{{Prevention:Regulators:Platform Security Assessments}}


<ref name="fantasmfinancetwitter-7241">[https://twitter.com/fantasm_finance/status/1501578166179094543 @fantasm_finance Twitter] (Mar 16, 2022)</ref>
=== Establish Industry Insurance Fund ===
The industry insurance fund can provide an additional treasury and resources in the event of a failure to secure the system, while also establishing validators to help ensure the situation in the first place.


<ref name="fantasmfinancetwitter-7242">[https://twitter.com/fantasm_finance/status/1501576486758887433 @fantasm_finance Twitter] (Mar 16, 2022)</ref>
{{Prevention:Regulators:Establish Industry Insurance Fund}}


<ref name="fantasmfinancetwitter-7243">[https://twitter.com/fantasm_finance/status/1501569232881995785 @fantasm_finance Twitter] (Mar 16, 2022)</ref>
{{Prevention:Regulators:End}}
 
<ref name="ftmscan-7244">[https://ftmscan.com/address/0x47091e015b294b935babda2d28ad44e3ab07ae8d#tokentxns Address 0x47091e015b294b935babda2d28ad44e3ab07ae8d | FtmScan] (Mar 16, 2022)</ref>
 
<ref name="fantasmfinancemedium-7245">[https://medium.com/@fantasmfinance/fantasm-finance-to-launch-synthetic-assets-on-fantom-ff31f954f5d https://medium.com/@fantasmfinance/fantasm-finance-to-launch-synthetic-assets-on-fantom-ff31f954f5d] (Mar 16, 2022)</ref>
 
<ref name="fantasmfinancemedium-7246">[https://medium.com/@fantasmfinance/the-fantasticdao-and-expansion-plans-fda82b6cc82 https://medium.com/@fantasmfinance/the-fantasticdao-and-expansion-plans-fda82b6cc82] (Mar 16, 2022)</ref>
 
<ref name="fantasmfinancemedium-7247">[https://medium.com/@fantasmfinance/fantasm-finance-post-mortem-exploit-09-march-2022-daf48ead016f https://medium.com/@fantasmfinance/fantasm-finance-post-mortem-exploit-09-march-2022-daf48ead016f] (Mar 16, 2022)</ref>
 
<ref name="bscscan-7248">[https://bscscan.com/tx/0x11407dd11dd028cfefdb24c9bde9163b4d10e3338e62c74ae2f5f3c2ec863133 https://bscscan.com/tx/0x11407dd11dd028cfefdb24c9bde9163b4d10e3338e62c74ae2f5f3c2ec863133] (Mar 16, 2022)</ref>
 
<ref name="bscscan-7249">[https://bscscan.com/tx/0xeffe3e64b2df1e80d5282a55bd12a7e89cd088616d85274bb1589b3b96526f28 https://bscscan.com/tx/0xeffe3e64b2df1e80d5282a55bd12a7e89cd088616d85274bb1589b3b96526f28] (Mar 17, 2022)</ref>
 
<ref name="bscscan-7250">[https://bscscan.com/tx/0xe47bd66738fd6721817ebc68cfdfde19d860330cc8b84bdf6761a3f1957ef188 https://bscscan.com/tx/0xe47bd66738fd6721817ebc68cfdfde19d860330cc8b84bdf6761a3f1957ef188] (Mar 17, 2022)</ref>
 
<ref name="bscscan-7251">[https://bscscan.com/tx/0x2b5f61778881958d98935cdfcbcb97a7de8405b1d059c931f02461776ad9e007 https://bscscan.com/tx/0x2b5f61778881958d98935cdfcbcb97a7de8405b1d059c931f02461776ad9e007] (Mar 17, 2022)</ref>
 
<ref name="ftmscan-7252">[https://ftmscan.com/tx/0x39be07303cf562407c857d9b43077f99bd63ee46b1a95d5cfe5947ee3c106422 Fantom Transaction Hash (Txhash) Details | FtmScan] (Mar 17, 2022)</ref>
 
<ref name="ftmscan-7253">[https://ftmscan.com/tx/0x455f72c451743bccfd9800c43bb56fcdd72d135247335ce07946c36974f5b799 Fantom Transaction Hash (Txhash) Details | FtmScan] (Mar 17, 2022)</ref>
 
<ref name="ftmscan-7254">[https://ftmscan.com/tx/0xed81960af5bba6cb7a48839ed9a6eed9b665cba4b9cfc1089603262e0082e9f2 Fantom Transaction Hash (Txhash) Details | FtmScan] (Mar 17, 2022)</ref>
 
<ref name="ftmscan-7255">[https://ftmscan.com/address/0x944b58c9b3b49487005cead0ac5d71c857749e3e Contract Address 0x944b58c9b3b49487005cead0ac5d71c857749e3e | FtmScan] (Mar 17, 2022)</ref>
 
<ref name="etherscan-7256">[https://etherscan.io/address/0x47091E015b294B935BAbDA2d28aD44e3Ab07ae8D https://etherscan.io/address/0x47091E015b294B935BAbDA2d28aD44e3Ab07ae8D] (Mar 17, 2022)</ref>
 
<ref name="beincrypto-7257">[https://beincrypto.com/fantasm-finance-loses-2-6-million-defi-exploit/ https://beincrypto.com/fantasm-finance-loses-2-6-million-defi-exploit/] (Mar 17, 2022)</ref>


== References ==
<references>
<ref name="slowmist-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 26, 2021)</ref>
<ref name="coinmarketcap-4651">https://coinmarketcap.com/currencies/ethereum/historical-data/ (Dec 21, 2021)</ref>
<ref name="fantasmfinance-7235">[https://fantasm.finance/ Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera] (Mar 16, 2022)</ref>
<ref name="fantasmfinance-7236">[https://fantasm-finance.gitbook.io/fantasm/ About Fantasm Finance - Fantasm] (Mar 16, 2022)</ref>
<ref name="fantasmfinancetwitter-7237">[https://twitter.com/fantasm_finance/status/1501911312510685187 fantasm_finance - "Dear Community, we have published a Post Mortem for the Fantasm Finance Exploit on 09 March 2022." - Twitter] (Mar 16, 2022)</ref>
<ref name="fantasmfinancetwitter-7238">[https://twitter.com/fantasm_finance/status/1504063662679543810 fantasm_finance - "935k whitehacked FTM will be evenly distributed on Friday 18th to all XFTM holders during the snapshot" - Twitter] (Mar 16, 2022)</ref>
<ref name="fantasmfinance-7239">[https://fantasm.finance/compensation Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera] (Mar 16, 2022)</ref>
<ref name="fantasmfinancetwitter-7240">[https://twitter.com/fantasm_finance/status/1501586619928924160 fantasm_finance - "we apologize for the exploit event which just happened. A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now." - Twitter] (Mar 16, 2022)</ref>
<ref name="fantasmfinancetwitter-7241">[https://twitter.com/fantasm_finance/status/1501578166179094543 fantasm_finance - "Update: Some of the FTM collateral reserve has been whitehacked" - Twitter] (Mar 16, 2022)</ref>
<ref name="fantasmfinancetwitter-7242">[https://twitter.com/fantasm_finance/status/1501576486758887433 fantasm_finance - "Please also exit from liquidity pools." - Twitter] (Mar 16, 2022)</ref>
<ref name="fantasmfinancetwitter-7243">[https://twitter.com/fantasm_finance/status/1501569232881995785 fantasm_finance - "URGENT ANNOUNCEMENT : Redeem your XFTM" - Twitter] (Mar 16, 2022)</ref>
<ref name="ftmscan-7244">[https://ftmscan.com/address/0x47091e015b294b935babda2d28ad44e3ab07ae8d#tokentxns Exploiter Address Token Transactions - FtmScan] (Mar 16, 2022)</ref>
<ref name="fantasmfinancemedium-7245">https://medium.com/@fantasmfinance/fantasm-finance-to-launch-synthetic-assets-on-fantom-ff31f954f5d (Mar 16, 2022)</ref>
<ref name="fantasmfinancemedium-7246">https://medium.com/@fantasmfinance/the-fantasticdao-and-expansion-plans-fda82b6cc82 (Mar 16, 2022)</ref>
<ref name="fantasmfinancemedium-7247">[https://medium.com/@fantasmfinance/fantasm-finance-post-mortem-exploit-09-march-2022-daf48ead016f Fantasm Finance Post Mortem: Exploit 09 March 2022] (Mar 16, 2022)</ref>
<ref name="bscscan-7248">[https://bscscan.com/tx/0x11407dd11dd028cfefdb24c9bde9163b4d10e3338e62c74ae2f5f3c2ec863133 Attacker Transfers Funds From TornadoCash - BscScan] (Mar 16, 2022)</ref>
<ref name="bscscan-7249">[https://bscscan.com/tx/0xeffe3e64b2df1e80d5282a55bd12a7e89cd088616d85274bb1589b3b96526f28 More Funds From TornadoCash - BscScan] (Mar 17, 2022)</ref>
<ref name="bscscan-7250">[https://bscscan.com/tx/0xe47bd66738fd6721817ebc68cfdfde19d860330cc8b84bdf6761a3f1957ef188 The Exploiter swaps BNB to USDC via Pancakeswap - BSCScan] (Mar 17, 2022)</ref>
<ref name="bscscan-7251">[https://bscscan.com/tx/0x2b5f61778881958d98935cdfcbcb97a7de8405b1d059c931f02461776ad9e007 The Exploiter bridges USDC to Fantom via Celer Bridge - BSCScan] (Mar 17, 2022)</ref>
<ref name="ftmscan-7252">[https://ftmscan.com/tx/0x39be07303cf562407c857d9b43077f99bd63ee46b1a95d5cfe5947ee3c106422 The Exploiter receives USDC from Celer Bridge - FtmScan] (Mar 17, 2022)</ref>
<ref name="ftmscan-7253">[https://ftmscan.com/tx/0x455f72c451743bccfd9800c43bb56fcdd72d135247335ce07946c36974f5b799 The Exploiter receives FTM from a faucet - FtmScan] (Mar 17, 2022)</ref>
<ref name="ftmscan-7254">[https://ftmscan.com/tx/0xed81960af5bba6cb7a48839ed9a6eed9b665cba4b9cfc1089603262e0082e9f2 Swap USDC for more FTM - FtmScan] (Mar 17, 2022)</ref>
<ref name="ftmscan-7255">[https://ftmscan.com/address/0x944b58c9b3b49487005cead0ac5d71c857749e3e Attacker Exploit Contract - FtmScan] (Mar 17, 2022)</ref>
<ref name="etherscan-7256">https://etherscan.io/address/0x47091E015b294B935BAbDA2d28aD44e3Ab07ae8D (Mar 17, 2022)</ref>
<ref name="beincrypto-7257">https://beincrypto.com/fantasm-finance-loses-2-6-million-defi-exploit/ (Mar 17, 2022)</ref>
<ref name="peckshieldalerttwitter-7258">[https://twitter.com/PeckShieldAlert/status/1501743350869012481 @PeckShieldAlert Twitter] (Mar 17, 2022)</ref>
<ref name="peckshieldalerttwitter-7258">[https://twitter.com/PeckShieldAlert/status/1501743350869012481 @PeckShieldAlert Twitter] (Mar 17, 2022)</ref>
<ref name="nipunpittwitter-7259">[https://twitter.com/nipun_pit/status/1501816047711580160 @nipun_pit Twitter] (Mar 17, 2022)</ref>
<ref name="nipunpittwitter-7259">[https://twitter.com/nipun_pit/status/1501816047711580160 @nipun_pit Twitter] (Mar 17, 2022)</ref>
<ref name="utoday-7260">[https://u.today/fantoms-defi-fantasm-finance-fsm-exploited-26-million-lost Fantom's DeFi Fantasm Finance (FSM) Exploited; $2.6 Million Lost] (Mar 17, 2022)</ref>
<ref name="utoday-7260">[https://u.today/fantoms-defi-fantasm-finance-fsm-exploited-26-million-lost Fantom's DeFi Fantasm Finance (FSM) Exploited; $2.6 Million Lost] (Mar 17, 2022)</ref>
 
<ref name="quillhashmedium-7261">[https://medium.com/quillhash/fantom-based-protocol-fantasm-suffers-2-6m-exploit-32de8191ccd4 Fantom Based Protocol Fantasm Suffers 2 6m Exploit - QuillAudits] (Mar 17, 2022)</ref>
<ref name="quillhashmedium-7261">[https://medium.com/quillhash/fantom-based-protocol-fantasm-suffers-2-6m-exploit-32de8191ccd4 Fantom Based Protocol Fantasm Suffers 2 6m Exploit] (Mar 17, 2022)</ref>
<ref name="ftmscan-7333">[https://ftmscan.com/tx/0x956e760143d3a029ae44fa2b60e8a7613ed937374b7e473109e3193e466f523a Fantasm Finance Exploit Transaction Transferring 52,844.411560322146244187 FTM - FtmScan] (Mar 20, 2022)</ref>
 
</references>
<ref name="ftmscan-7333">[https://ftmscan.com/tx/0x956e760143d3a029ae44fa2b60e8a7613ed937374b7e473109e3193e466f523a Fantom Transaction Hash (Txhash) Details | FtmScan] (Mar 20, 2022)</ref></references>

Latest revision as of 11:02, 10 July 2023

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Fantasm Finance

Fantasm Finance is a protocol creating a synthetic token which is 1:1 pegged against the Fantom token. Due to a missing condition check for the minimum amount of fantom, the smart contract hot wallet was vulnerable. A malicious user exploited this and made off with over 1,007 ETH from the hot wallet. Some remaining funds were whitehacked by the protocol team, and distributed to users. While the hacker has been made an offer, and there is some suspicion of who they are, no offer to return the funds appears to be on the table, nor has the Fantasm team come forward, so it appears that affected users bear the full impact of the breach.

This is a global/international case not involving a specific country.[1][2][3][4][5][6]

About Fantasm Finance

[7][8][9][10][11]

"Dear Fantomians, we’re excited to announce the launch of Fantasm Finance!" "Welcome to Fantasm. Fractional-Algorithmic Synthetic Token pegged to the value of 1 FTM on Fantom Opera."

"Fantasm Finance is a DeFi project aimed at developing and popularizing synthetic tokens for the Fantom Ecosystem. Imagine having exposure to the price of FTM token without actually owning it. That’s not fantasy: it’s #Fantasm."

"With Fantasm Finance we introduce a decentralized solution to scale up volume of the FTM token by using our partial collateralized design where synthetic token supply of xFTM will be partially backed by FTM and partially by the FSM token. xFTM is a Fractional-Algorithmic Synthetic Token pegged to the value of 1 FTM on Fantom Opera."

"xFTM is a synthetic token pegged to the price of the FTM cryptocurrency on the Fantom Network. It is a fractional-algorithmic synthetic token pegged 1:1 to the dollar value of 1 FTM. In other words, the price of 1 xFTM equals 1 FTM."

TBD - Expand about section - see the template.

The Reality

What Happened

"On March 09, starting at approximately 02:00 p.m. UTC, suspicious transactions related to the Fantasm protocol which resulted in a loss of $2.62M."

Key Event Timeline - Fantasm Finance Contract Vulnerabilities
Date Event Description
March 9th, 2022 6:34:12 AM MST Funds Transferred From Tornado Cash The attacker transfers BNB from the Tornado Cash protocol in two transactions[12][13][14].
March 9th, 2022 6:36:06 AM MST Swapping BNB To USDC The attacker swaps their BNB to the USDC stablecoin[14][15].
March 9th, 2022 6:39:21 AM MST USDC Bridged To Fantom Network The attacker uses the Celer Bridge to bring their USDC onto the Fantom network[14][16]. They ultimately receive their USDC[17].
March 9th, 2022 6:46:57 AM MST Attacker Obtaining FTM The attacker obtains more FTM via a faucet and a swap from USDC[18][19][14].
March 9th, 2022 6:49:26 AM MST Exploit Contract Deployed The attacker deploys an exploit contract[14][20][21].
March 9th, 2022 7:42:00 AM MST Urgent Announcement on Twitter Fantasm Finance posts an urgent announcement on Twitter, recommending that all users redeem their XFTM. There is still a 1,820,012 FTM pool balance remaining at this time[22]. The exploiter address is provided[23].
March 9th, 2022 8:11:00 AM MST Exit From Liquidity Pools Fantasm Finance recommends that users exit from their liquidity pools[24].
March 9th, 2022 8:18:00 AM MST Some Collateral Whitehacked Fantasm Finance posts to Twitter to announce that some of the FTM collateral reserve was whitehacked[25].
March 9th, 2022 8:20:36 AM MST Fantasm Finance Exploited Exploit transaction on the blockchain[26].
March 9th, 2022 8:52:00 AM MST Twitter Apology Announcement Fantasm Finance posts an announcement/apology on their Twitter, acknowledging the exploit and that they are still investigating it further[27].
March 10th, 2022 6:22:00 AM MST Post-Mortem Published Fantasm Finance publishes their post-mortem on the incident[14]. This is shared on their Twitter[28]. TBD more Twitter review. TBD review post-mortem and add in more timeline.
March 11th, 2022 10:03:23 PM MST QuillAudits Summary Included QuillAudits reports that Fantasm Finance, an algorithmic trading platform operating on the Fantom network, experienced an exploitation incident. The hacker managed to convert the platform's profits, amounting to $2.73 million (1,007 ETH), into ETH and redirected the funds through Tornado Cash[29].
March 16th, 2022 5:54:00 AM MDT WhiteHack FTM Distribution Fantasm Finance announces that they will be distributing 935k of whitehacked Fantom tokens to affected users[30]. TBD more review.

Technical Details

"On March 09, starting at approximately 02:00 p.m. UTC, suspicious transactions related to the Fantasm protocol which resulted in a loss of $2.62M."

[26]

"The Exploiter [got] funds from BNB Chain via Tornado Cash", swapped "BNB to USDC via Pancakeswap", and "USDC to Fantom via Celer Bridge". "The Exploiter receive[d] USDC from Celer Bridge" and "FTM from a faucet". They then "Swap[ped] USDC for more FTM" and "deploy[ed] a contract [to] trigger the exploit".

"That contract exploited the error in Fantasm’s Pool contract where the developer missed the condition checking for the minimum amount of input FTM when minting XFTM." "This contract deployed by Exploiter repeatedly [minting] XFTM by input only FSM token without entering any FTM, collect[ing] XFTM token, [selling] XFTM token to FTM, buy[ing] more FSM and repeat the first step to get a larger amount of FTM."

"After exploiting the vulnerability, the hacker exchanged all the profits for ETH, and used Tornado.cash to mix coins across the chain to the Ethereum main network. According to statistics, the hacker made a profit of 1,007 ETH (about 2.73 million US dollars)." "Eventually, the exploiter sold all his FTM for ETH and bridged these ETH to Ethereum, again via Celer Bridge. The total amount exploited is 1008.498875252390151 ETH (approximately $2,622,097)"

Total Amount Lost

The total amount lost has been estimated at $2,626,000 USD.

[31]

Exploiter address: [23] TBD follow this address.

52,844.411560322146244187 FTM transfered on March 9th, 2022.

Immediate Reactions

"Fantom’s on-chain synthetic asset protocol, Fantasm Finance, posted on social media that its FTM collateral reserves had been exploited, and called on users to exchange their XFTM immediately."

"URGENT ANNOUNCEMENT : Redeem your XFTM. Our FTM collateral reserve has been exploited, there is still 1,820,012 FTM pool balance remaining currently for redemption." "Please also exit from liquidity pools."

"Update: Some of the FTM collateral reserve has been whitehacked."

"[W]e apologize for the exploit event which just happened. A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now. Most sincere apologies once again."

Fantasm Finance Twitter Announcement

Fantasm Finance initially posted a couple of urgent announcements and recommendations[22][24].

URGENT ANNOUNCEMENT : Redeem your XFTM

Our FTM collateral reserve has been exploited, there is still 1,820,012 FTM pool balance remaining currently for redemption.

Exploiter address:

https://ftmscan.com/address/0x47091e015b294b935babda2d28ad44e3ab07ae8d#tokentxns

We are looking into this right now, more details to follow immediately

Please also exit from liquidity pools.

They later followed this up with an announcement/apology on their Twitter[27].

Dear Community,

we apologize for the exploit event which just happened.

A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now.

Most sincere apologies once again.

Ultimate Outcome

Fantasm Finance "performed a forensics analysis to provide more insight into transactions and actions taken by the exploiter."

"We have patched the vulnerability and shared the newly committed code with our auditor."

"[W]e have 935,415 FTM from white hacking the protocol ourselves once we became aware of the exploit. We will return this to users via a snapshot compensation at block height 32970600. This part will be returned to XFTM holders." "935k whitehacked FTM will be evenly distributed on Friday 18th to all XFTM holders during the snapshot. Under the Compensation Tab you can see your XFTM & FSM holdings at snapshot. There were around 4.9m XFTM at that time."

"We once again deeply apologize for the inconveniences caused by this. We encourage the attacker to reach out to the Fantasm team and begin a dialogue for the return of our users’ funds. They are impacting everyday users of DeFi and we would like them to do the right thing. We will honor a bug bounty of 10% upon returning of funds."

Fantasm Finance Post-Mortem

Fantasm Finance ultimately publishes a post-mortem on the incident[14][28].

Dear Fantasm Community and Partners, we would first and again like to sincerely apologize for the exploit which occurred yesterday. We also want to thank everyone who has helped us in handling this event and supported us in fixing the code vulnerability. We have patched the vulnerability and shared the newly committed code with our auditor.

Third Party Reports

[29]

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Fantams finance distributed whitehacked funds[30].

Ongoing Developments

TBD

Individual Prevention Policies

The Fantasm Finance smart contract had limited smart contract validation performed by a single smart contract auditing firm. This failed to catch the missing condition check. Users should not have trusted their funds to a platform with only a single validation.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This could have been prevented through further audits or storing funds in a multi-signature wallet. An industry insurance fund can assist affected users.

Further Smart Contract Auditing

Having two audits completed prior to launch, and a third audit after 3 months would have greatly decreased the chance the missing validation went unnoticed.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Implement Multi-Signature Wallet

As an alternative, having the majority of funds inaccessible to the normal functions of the smart contract would prevent their theft. Instead, these funds could be made available through a multi-signature wallet requiring a signed transaction from multiple individuals. This would limit the theft to only those funds in the hot wallet.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

Establish Industry Insurance Fund

The industry insurance fund can provide an additional treasury and resources in the event of a failure to secure the system, while also establishing validators to help ensure the situation in the first place.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

This could have been prevented through further audits or storing funds in a multi-signature wallet. An industry insurance fund can assist affected users.

Further Smart Contract Auditing

Having two audits completed prior to launch, and a third audit after 3 months would have greatly decreased the chance the missing validation went unnoticed. In addition, third parties may be able to suggest more secure fund storage structures such as a multi-signature treasury.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Establish Industry Insurance Fund

The industry insurance fund can provide an additional treasury and resources in the event of a failure to secure the system, while also establishing validators to help ensure the situation in the first place.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.

References

  1. ↑ SlowMist Hacked - SlowMist Zone (Jun 26, 2021)
  2. ↑ https://etherscan.io/address/0x47091E015b294B935BAbDA2d28aD44e3Ab07ae8D (Mar 17, 2022)
  3. ↑ https://beincrypto.com/fantasm-finance-loses-2-6-million-defi-exploit/ (Mar 17, 2022)
  4. ↑ @PeckShieldAlert Twitter (Mar 17, 2022)
  5. ↑ @nipun_pit Twitter (Mar 17, 2022)
  6. ↑ Fantom's DeFi Fantasm Finance (FSM) Exploited; $2.6 Million Lost (Mar 17, 2022)
  7. ↑ Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera (Mar 16, 2022)
  8. ↑ About Fantasm Finance - Fantasm (Mar 16, 2022)
  9. ↑ Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera (Mar 16, 2022)
  10. ↑ https://medium.com/@fantasmfinance/fantasm-finance-to-launch-synthetic-assets-on-fantom-ff31f954f5d (Mar 16, 2022)
  11. ↑ https://medium.com/@fantasmfinance/the-fantasticdao-and-expansion-plans-fda82b6cc82 (Mar 16, 2022)
  12. ↑ Attacker Transfers Funds From TornadoCash - BscScan (Mar 16, 2022)
  13. ↑ More Funds From TornadoCash - BscScan (Mar 17, 2022)
  14. ↑ 14.0 14.1 14.2 14.3 14.4 14.5 14.6 Fantasm Finance Post Mortem: Exploit 09 March 2022 (Mar 16, 2022)
  15. ↑ The Exploiter swaps BNB to USDC via Pancakeswap - BSCScan (Mar 17, 2022)
  16. ↑ The Exploiter bridges USDC to Fantom via Celer Bridge - BSCScan (Mar 17, 2022)
  17. ↑ The Exploiter receives USDC from Celer Bridge - FtmScan (Mar 17, 2022)
  18. ↑ The Exploiter receives FTM from a faucet - FtmScan (Mar 17, 2022)
  19. ↑ Swap USDC for more FTM - FtmScan (Mar 17, 2022)
  20. ↑ Attacker Exploit Contract - FtmScan (Mar 17, 2022)
  21. ↑ Exploit Contract Creation - FtmScan (Apr 25, 2023)
  22. ↑ 22.0 22.1 fantasm_finance - "URGENT ANNOUNCEMENT : Redeem your XFTM" - Twitter (Mar 16, 2022)
  23. ↑ 23.0 23.1 Exploiter Address Token Transactions - FtmScan (Mar 16, 2022)
  24. ↑ 24.0 24.1 fantasm_finance - "Please also exit from liquidity pools." - Twitter (Mar 16, 2022)
  25. ↑ fantasm_finance - "Update: Some of the FTM collateral reserve has been whitehacked" - Twitter (Mar 16, 2022)
  26. ↑ 26.0 26.1 Fantasm Finance Exploit Transaction Transferring 52,844.411560322146244187 FTM - FtmScan (Mar 20, 2022)
  27. ↑ 27.0 27.1 fantasm_finance - "we apologize for the exploit event which just happened. A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now." - Twitter (Mar 16, 2022)
  28. ↑ 28.0 28.1 fantasm_finance - "Dear Community, we have published a Post Mortem for the Fantasm Finance Exploit on 09 March 2022." - Twitter (Mar 16, 2022)
  29. ↑ 29.0 29.1 Fantom Based Protocol Fantasm Suffers 2 6m Exploit - QuillAudits (Mar 17, 2022)
  30. ↑ 30.0 30.1 fantasm_finance - "935k whitehacked FTM will be evenly distributed on Friday 18th to all XFTM holders during the snapshot" - Twitter (Mar 16, 2022)
  31. ↑ https://coinmarketcap.com/currencies/ethereum/historical-data/ (Dec 21, 2021)
Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Fantasm_Finance_Contract_Vulnerabilities&oldid=4779"