Belt Finance Untightens Itself

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Belt Finance

The Belt Finance smart contract used the pricing information of their limited size market to determine the price of assets on the exchange liquidity pool.

A user borrowed a large amount of money via a flash loan, and used it to manipulate the price in a favourable way. The smart contract did what it was programmed to do, and provided that user with $6.3m in profit.

This is a global/international case not involving a specific country.

About Belt Finance

Belt Finance is "[t]he conveyor Belt of optimized yield to your assets," "an AMM protocol incorporating multi-strategy yield optimization." "Belt.fi smart contracts are forked from yearn.finance, Curve, and Pickle Finance to combine the maximal benefits of the three." "The 4Belt BLP Pool is at its basis, a liquidity pool." An "audit was conducted by SOOHO, a CONSENSYS-backed blockchain security firm." Another "was conducted by HAECHI AUDIT." "Belt.fi is in beta. Please DYOR and use at your own risk." "Belt is a service designed for bringing peace of mind to its users."

"Belt Finance was attacked with a flash loan exploit and suffered damages to [their] funds, and more importantly, to the trust of our users." "A hacker exploited Belt Finance with a flash loan attack to steal over $6.2M BUSD. The attacker was able to manipulate the beltBUSD price by exploiting a balance calculation bug in the bEllipsisBUSD strategy contract."

"On May 29, 2021, a flash loan attack was initiated on the BSC 4Belt (USDT/USDC/BUSD/DAI) pool. The attacker created a smart contract that used PancakeSwap for flash loans and exploited our beltBUSD pool and its underlying strategy protocols and then proceeded to execute the contract 8 times for a total profit of 6,234,753 BUSD. beltBUSD vault users suffered a 21.36% loss of funds, while 4Belt pool users suffered a 5.51% loss of funds. No other pools/vaults were affected."

"The attacker acquired a flash loan of around 390 million BUSD from PancakeSwap for the exploit, which is close to the maximum amount of BUSD that could be garnered from all pools with BUSD on PancakeSwap. The attacker then deposited around 200 million BUSD of it into the beltBUSD vault (with Venus as the strategy protocol) so the ratio between strategies was shifted heavily towards Venus. Before the attack, the beltBUSD vault had a ratio split of around 60M BUSD in Venus, 60M BUSD in Alpaca, 60M BUSD in Ellipsis, and 20M BUSD in ForTube for a total of about 200M BUSD. The attacker’s deposit made it so that the Venus strategy had around 260M BUSD, so the total of beltBUSD was around 400M."

"The attacker’s contract simultaneously moved 190M BUSD to the Ellipsis.fi 3pool to exchange 190M BUSD to around 169.5M USDT. This swap resulted in a significant increase of the value of Ellipsis 3pool LP. The 3pool LP supply change did not change but this $21.5M difference went to increase the value of the 3pool LP by around 3%. This in turn increased the value of the Ellipsis strategy of the 4Belt pool 3% from 60M BUSD to 61.8M BUSD, raising the whole beltBUSD vault from 400M BUSD to 401.8M BUSD (a 0.5% gain)."

"The attacker then withdrew from the beltBUSD vault for a gain of around 0.5% on their 200M BUSD deposit, or about 1M BUSD (201M BUSD withdrawn from a 200M BUSD deposit). The attacker then swapped back the USDT to BUSD on Ellipsis, returning the LP to its previous value, and thus left the beltBUSD vault with a 1M BUSD loss."

"The attacker’s smart contract then repeated this cycle multiple times in this same transaction (as much the Tx gas limit maximum allowed), covering the flash loan fee and Ellipsis swap fees to eventually leave a profit. The attacker then took the BUSD profit to their address and swapped it to anyETH before using the Nerve Bridge to send their anyETH to the Ethereum Mainnet." "[T]he attackers managed to exploit this bug eight times before being detected."

Belt "paused withdrawals and deposits as soon as [they] were aware of the attack to prevent further losses and protect [their] users and their assets." "[B]eltBUSD pool’s loss was a total 50 million BUSD with the 43.8 million in fees added to the 6.23 million in profits taken by the attacker."

The platform most recently "sought to find a solution that would hopefully return the trust vested in us, by the way of compensating our users for our shortcomings." "A snapshot of the 4Belt pool and 4BELT token holders will be taken and users affected by the exploit will be airdropped the remedy4BELT (r4BELT) token in proportion to their 4Belt LP and/or beltBUSD holdings before the attack. The r4BELT token will be used as a tool to mark the users that were affected by the attack. Users affected by the attack can use their r4BELT to receive compensation over time." "From the team’s build allocation, 67% of the unlocked portion will be distributed to r4BELT compensation. This amounts to 864 BELT per day." "The BELT mining rate will stay the same but 15% of the distribution will now go to the 4BELT- r4BELT LP pool." "We are also committing $3 million USD to create a new BELT Buyback fund."

"The Belt Finance team is committed to reversing the damages incurred in regards to this recent incident, and remains committed to developing Belt Finance to be the best DeFi protocol possible." "Withdrawals from all pools/vaults are now open. We have taken the utmost caution in reviewing our code before reopening and have upgraded our monitoring tools. We are also having additional audits performed. We apologize for the inconvenience."

"Target timeline for the new compensation plan: 6/15 - Details on the new plan, 6/16 - New audit report, 6/18 - r4BELT token airdrop, 6/24 - Compensation begins". As of June 16th, Belt Finance completed an audit by SOOHO. "Affected users will receive the r4belt airdrop from the Belt team on June 18th."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Belt Finance Untightens Itself

Date	Event	Description
May 28th, 2021	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $6,300,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

In a smart contract environment, the use of a proper price oracle can prevent such exploits.

In general, an exchange platform could keep funds safer by placing the majority of them in an offline multi-signature arrangement. Smart contracts are effectively open source hot wallets.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.