Whale Loans Swap Amount Exploit

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Whale Loans Logo/Homepage

Whale Loans aimed to simplify the decentralized finance experience for users. One service allowed users to swap easily between USDT (Tether) and BUSD (Binance's stablecoin). Unfortunately, this smart contract was vulnerable due to incorrectly calculating the swap reward amount. In total, the attacker profited $12k. It is not clear if users of the project were reimbursed. The project appears to be offline presently.

This is a global/international case not involving a specific country.

About Whale Loans

"Whale Loans​ is a venture focused on designing a scalable and defendable ecosystem that removes the complexity in and around DeFi and distributes value to its users. In layman’s terms, we are creating an “easy button” for a better user experience."

"​Whale Loans will be introducing several products for stablecoins so that users can earn attractive yields without committing to long lockup periods, allowing anyone to become a whale. Our ecosystem will bring additional value to the token beyond the traditional rebase token strategies. For further information on the token, see the tokenomics."

On June 20, 2022 Whale Loans lost $12K due to incorrectly calculating swap reward amount.

"On 20 June, Whale Finance experienced two separate exploits on the project's stablecoin AMM contracts, which has led to ~$12k in losses. The attacker called the swap() function from the USDT/BUSD pool which had a vulnerability, which was primarily caused by an incorrect k invariant calculation when the swap pair is a stablecoin."

"The attacker called the function swap() from the Stable AMM -USDT/BUSD contract. The input amount of USDT(BSC-USD) is 5964, which is the balance of the USDT in the Stable AMM -USDT/BUSD contract. The attacker sent back 0.6 USDT to the Stable AMM -USDT/BUSD contact. After the fee adjustment, the balance0Adjusted = 6022457770012534500304, IN3 and the balance1Adjusted = 59471946427871433983220000, which means the k invariant value is 1266806331900666880877818210684878792429048115. However, the reserve0 and reserve1 are 59646190399283805000316 and 5947194642787143398322 respectively. Their corresponding k invariant value is 2516642811824473716920890881639825. If it is multiplied by 10000**2 = 100_000_000, the result is still less than the k invariant given by the balance0Adjusted and balance1Adjusted. In this case, the k invariant validation was bypassed."

"Therefore, the Stable AMM - USDT/BUSD contract transferred the 5964 USDT to the attacker successfully. Similarly, the attacker called the function swap() twice to swap the BUSD with input amount 5947 and 62 of BUSD, respectively. Due to the same vulnerability, the Stable AMM -USDT/BUSD contract transferred 5947 and 62 BUSD to the attacker directly. The attacker applied the same strategy to the Stable AMM-USDC/BUSD with 232 USDC and 232 BUSD as profit. In total, the attacker made a profit of $12K."

"On the projects Discord, @coj337 who is the servers admin stated that due to the exploit, Whale.Finance has taken down the DEX whilst the vulnerability is being assessed. It has also been announced that no customer funds were lost due to the exploit."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Whale Loans Swap Amount Exploit

Date	Event	Description
April 21st, 2021 4:06:59 PM MDT	First Website Capture	The first capture of the Whale Loans website.
January 3rd, 2022 3:35:47 PM MST	First Conetnt Capture	The first capture of the website with content. It is not clear if the website was operational prior to this point.
June 20th, 2022 7:16:12 AM MDT	First Exploit Transaction	The first exploit transaction on the blockchain.
June 20th, 2022 7:41:28 AM MDT	Second Exploit Transaction	A second exploit transaction on the blockchain.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $12,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.