LW Token Price Manipulation Attack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

LW Token Price Chart

Little is known about the LW token. It doesn't appear to have an official website and there is limited references on social media, however it traded on PancakeSwap and was listed on several sites. On May 11th, the price spiked and rapidly fell due to a flash loan exploit. Approximately $48k worth of BNB was removed and brought to TornadoCash.

About LW Token

"The Warden system based on data from 1.000.000+ SmartContract, this contract has 95% to be a RugPull or HoneyPot!"

"The LW token on BSC was attacked, with a loss of 48,415 USDT, and the price of LW token plummeted by 69%. The attackers have transferred about 150 BNB to Tornado Cash."

"According to news from PANews on May 12, according to Paidun’s early warning and monitoring, the LW token on BSC was attacked, with a loss of 48,415 USDT, and the price of LW token plummeted by 69%. The attacker has transferred about 150 BNB to Tornado Cash."

"#MetaTrustAlert Our #MetaScout detected that $LW on BSC was attacked by the flashloan with a loss of ~48.4k $USD." "$LW is exploited (w/ 48,415 $USDT) $LW has dropped -69%"

"We identified an exploit on $LW token, on the PancakeSwap pair of $LW - $BUSD that resulted in an accumulated theft of ~$48k. The exploiting contract, utilizing a flashswap on the contract to conduct the attack, deployed around *10 hours* before the attack happened"

"The LW token on #BSC was attacked, with a loss of 48,415 USDT, and the price of $LW token plummeted by 69%. The attackers have transferred about 150 #BNB to Tornado Cash."

"It is a price manipulation attack.

In this attack, the marketAddr account has 173,272 $USDT, which is used to buy back the $LW and increase the price of the $LW.

The attacker first swapped $USDT for the $LW

The attacker triggered the buy-backs of $LW and increased the price of $LW

Finally, the attacker swapped $LW for the $USDT"

"The $LW exploiter has already transferred ~150 $BNB into Tornado Cash."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - LW Token Price Manipulation Attack

Date	Event	Description
May 11th, 2023 3:00:00 AM MDT	Added To DexKoala	The LW trading pair is added to DexKoala. There are reportedly 6 token holders at this time.
May 11th, 2023 9:46:00 AM MDT	Malicious Smart Contract Created	The exploiter creates a malicious smart contract which would later be used in the attack. The smart contract is populated with a balance of 0.001 BNB.
May 11th, 2023 10:29:00 AM MDT	LW Smart Contract Exploited	The exploit transaction occurs on the Binance Smart Chain. TBD need to explain it.
May 11th, 2023 8:10:15 PM MDT	First Exploit Transaction	The first exploit transaction occurs. The smart contract makes repeated payments of 1 wei. TBD need to explain it.
May 11th, 2023 8:11:39 PM MDT	Second Exploit Transaction	The second exploit transaction occurs. TBD need to explain it.
May 11th, 2023 8:29:54 PM MDT	Funds Moving To TornadoCash	The first transaction starts moving the funds through TornadoCash.
May 11th, 2023 8:32:42 PM MDT	Funds Moving To TornadoCash	The final transaction moving the funds through TornadoCash.
May 11th, 2023 8:35:00 PM MDT	PeckShield Alert	PeckShield alerts and posts an announcement on Twitter about the exploit. They reference the exploit transaction.
May 11th, 2023 8:42:00 PM MDT	TornadoCash Transfer Reported	PeckShield reports that the exploiter has already cashed their 150 BNB token through TornadoCash. They include a link to the exploiter's BSC wallet.
May 11th, 2023 8:48:27 PM MDT	PANews Article Reported	A PANews article is published about the situation, referencing the PeckShield tweet.
May 12th, 2023 12:15:00 AM MDT	MetaTrust Alert Tweet	MetaTrust posts an alert and analysis on Twitter about the exploit including a detailed technical analysis.
May 12th, 2023 9:52:00 AM MDT	Hexagate Analysis Tweet	Hexagate reported on the situation on Twitter, and notes that the smart contract used a flashswap and was deployed 10 hours before the attack happened.
May 12th, 2023 5:42:00 PM MDT	DeDotFiSecurity Analysis Tweet	DeDotFiSecurity posts an analysis of the exploit on Twitter, noting that roughly $48k was taken and the LW token experienced a drop in price of roughly 80%.
May 13th, 2023 10:59:00 AM MDT	TronWeekly Report	TronWeekly reports with a new tweet about the LW token attack.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Exploiter BSC Wallet:

Transactions: (DeDotFiSecurity) (MetaTrust/Hexagate)

Transaction Stealing Funds $48,415 USDT (DeDotFiSecurity):

https://bscscan.com/tx/0xd0dd0c8aa71860ff2d7fe6f9763892d936e31fb8c1aef01ec5ffbc947dbedbeb

A couple of transactions (Hexagate,MetaTrust)

https://bscscan.com/tx/0xb846f3aeb9b3027fe138b23bbf41901c155bd6d4b24f08d6b83bd37a975e4e4a

https://bscscan.com/tx/0x96b34dc3a98cd4055a984132d7f3f4cc5a16b2525113b8ef83c55ac0ba2b3713

Exploiting Contract Address

https://bscscan.com/address/0xa4fbc2c95ac4240277313bf3f810c54309dfcd6c

[1]Exploit Transaction 2 - As Reported By Hexagate - BscScan

The attacker then transferred their gains into TornadoCash.

MetaTrust Technical Analysis

MetaTrust published a technical analysis on Twitter.

#MetaTrustAlert Our #MetaScout detected that $LW on BSC was attacked by the flashloan with a loss of ~48.4k $USD.

The price of $LW has dropped ~21.5%

It is a price manipulation attack.

In this attack, the marketAddr account has 173,272 $USDT, which is used to buy back the $LW and increase the price of the $LW.

The attacker first swapped $USDT for the $LW

The attacker triggered the buy-backs of $LW and increased the price of $LW

Finally, the attacker swapped $LW for the $USDT

Hexagate Technical Analysis

Hexagate published a brief technical analysis of the exploit.

We identified an exploit on $LW token, on the PancakeSwap pair of $LW - $BUSD that resulted in an accumulated theft of ~$48k. The exploiting contract, utilizing a flashswap on the contract to conduct the attack, deployed around *10 hours* before the attack happened

DeDotFiSecurity Technical Analysis

The DeDotFiSecurity team posted a technical analysis on Twitter on the day after the exploit.

$LW Token Exploit

~ $48k has been stolen due to the exploit on the $LW token, specifically on the PancakeSwap pair of $LW - $BUSD.

As a result of the exploit, the $LW token has experienced a significant drop of approximately -80%.

Transaction Link Stolen Amount: ~$48,415 USDT

The attacker deployed the exploiting contract around 10 hours before the attack occurred

The $LW exploiter has already transferred around 150 $BNB into @TornadoCash

SlowMist Event Description

SlowMist included the event on their website with a brief description. They referenced the PANews report.

Description of the event: The LW token on BSC was attacked, with a loss of 48,415 USDT, and the price of LW token plummeted by 69%. The attackers have transferred about 150 BNB to Tornado Cash. Amount of loss: $ 48,415 Attack method: Contract Vulnerability

Total Amount Lost

Loss estimates vary between $48k and $48,415k, and were in USDT so there is no conversion factor to consider.

The total amount lost has been estimated at $48,000 USD.

Immediate Reactions

Aside from some initial investigation and analysis by MetaTrust, Hexagate, DeDotFiSecurity, and SlowMist, there do not appear to have been any strong or notable reactions to the situation.

Ultimate Outcome

The funds were ultimately moved through TornadoCash by the attacker.

Total Amount Recovered

There do not appear to have been any funds recovered in this case. The culprit moved funds through TornadoCash.

Ongoing Developments

There do not appear to be any remaining ongoing developments in this case.

Individual Prevention Policies

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.