Decentralized Finance (DCF) Flash Loan Price Manipulation Attack

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

DCF Token Logo/Homepage

The Decentralized Finance (DCF) platform offers a comprehensive ecosystem with features such as DCF Play, GameFi, a commercial payment system, a social network, messaging, livestream services, and a DAO for governance. A hack exploited vulnerabilities in the victim contract’s exchange functionality, manipulating the exchange rate through large token swaps on PancakeSwap. The hacker swapped DCF tokens for BUSD, then manipulated the rate before exchanging BUSD back into the contract, causing a loss of $9,000. The issue arose from flawed logic in the swap process, where the DUSD/DCF exchange rate was not properly secured. It does not appear that the project has publicly acknowledged the hack or any plans for restitution.

About DCF Token

The Decentralized Finance (DCF) platform offers a decentralized ecosystem with various features, including DCF Play, GameFi, a Commercial Payment Ecosystem, an Online Social Network, Messaging & Livestream services, and a DAO Community for collaborative governance. Users can increase profits through decentralized income sources and interact within a secure and decentralized environment. The platform also outlines its tokenomics, with mining rewards making up 45% and other funds allocated for games, ecosystem growth, reserves, marketing, presale, and development. The roadmap spans from Q4 2024 to Q4 2025, detailing milestones such as token creation, presale, game releases, community expansion, decentralized social network launch, and DAO establishment. Key partners include SafePal, MetaMask, PancakeSwap, and more.

The recently launched DCF Pro Farming launch smart contract offered users a chance to earn significant returns through multiple revenue streams, including PancakeSwap tax, DCF swap fees, and profits from the GameFi ecosystem. Users can invest in flexible plans ranging from $100 to $50,000, with term options of 7, 14, or 28 days. Withdrawals are easy, with no fee for on-time exits and a 5% fee for early withdrawals. The platform promises monthly profits of 10-15%, and participants have the chance to become shareholders, sharing in the project's sustainable profits.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

"Decentralized Finance (DCF) was attacked on the BSC chain, resulting in a loss of approximately $8,800."

Key Event Timeline - Decentralized Finance (DCF) Flash Loan Price Manipulation Attack

Date	Event	Description
September 10th, 2024 6:04:22 PM MDT	DCF Smart Contract Launch	The DCF smart contract is first launched on Binance Smart Chain.
December 10th, 2024 6:11:49 AM MST	DCF USD Contract Launched	An updated Decentralized Finance DUSD stable coin is launched on Binance Smart Chain.
December 11th, 2024 7:08:00 PM MST	DCF Smart Contract Announcement	According to a tweet posted by DCF to Twitter, "The DCF Pro platform has updated the smart contract for DUSD tokens to ensure maximum safety and security."
December 15th, 2024 6:25:00 AM MST	DCF Farming Launch Announced	Decentralized finance announces the launch of DCF Pro Farming via their Twitter/X account, offering users a chance to earn substantial returns through a variety of revenue streams, including PancakeSwap taxes, DCF swap fees, and GameFi profits. Investors can choose flexible plans ranging from $100 to $50,000, with terms of 7, 14, or 28 days. Withdrawals are simple, with no fees for on-time exits and a 5% fee for early withdrawals. The platform promises projected monthly profits of 10-15%, and participants can even become shareholders, benefiting from the project’s long-term profits.
December 15th, 2024 11:21:55 AM MST	Binance Smart Chain Transaction	The reported exploit transaction on the Binance Smart Chain.
December 16th, 2024 11:02:00 AM MST	Tikkala Research Announcement	Tikkala research shares an announcement about the exploit, which affected the same project as they had previously reported on. They point out that the exploiter was already nicknamed "vETH Exploiter 1", so they have a history.
December 17th, 2024 2:16:00 AM MST	Nick L Franklin Analysis	Nick L Franklin posts a technical analysis of the exploit.

Technical Details

The Decentralized Finance victim contract has exchange functionality, relying on the PancakeSwap V2 pair to determine exchange rates. This setup can be easily exploited by manipulating the exchange rates through large token swaps on PancakeSwap.

In this case, the hacker exploited the vulnerability by exchanging almost all DCF tokens in the victim contract for BUSD. Then, they swapped a massive amount of BUSD for DCF on PancakeSwap, artificially manipulating the exchange rate. Following this, the hacker was able to exchange the BUSD back into the victim contract using a small number of DCF tokens, resulting in a total loss of approximately $9,000.

"Decentralized Finance(DCF) hacked. Victim contract has exchange functionality, but it gets exchange rate using pancakeswap v2 pair. This can be easily manipulated by exchanging huge amount of tokens on pancake swap. Hacker exchanged almost all DCF token in victim contract to BUSD. Then, exchanged huge amount of BUSD to DCF on pancakeswap, exchange rate manipulated. After that, he exchanged gained almost all BUSD in victim contract using a few DCF tokens. Total loss is about $9k."

"The root cause is the logic when the project swap between BUSDT, DUSD(Their token) and DCF(Their token). It binds BSDT/DUSD as 1:1 but put DUSD/DCF somewhat dynamic. It didn't set the swap K (reserve number) after the swap."

Total Amount Lost

Amount of loss: $ 8,800

The total amount lost has been estimated at $9,000 USD.

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.