The Main Cause of Vee Finance Attack

  1. Price acquisition has not been processed for decimals.
  1. When an order is created, the token exchange will be carried out through line 5 of the following code block.
  2. Before the token exchange, the expected slippage will be checked through the getAmountOutMin function on line 9 of the following code block.
  3. During slippage check, the priceA and PriceB quotes of the oracle will be obtained through lines 12 and 13 of the following code block, and then the number of TokenA that can be exchanged for TokenB at the current price is calculated through line 15 of the following code block. Finally, compare with the number of tokens acquired in the Pangolin pool. If the number of TokenB tokens that can be exchanged in the pool is greater than or equal to the expected number of TokenB that can be exchanged using the oracle, then it can be judged that the pool price is correct and not controlled, and the order creation logic is continued.
  1. No support for tokens with a single source of price feed.
  2. Modify the contract call check to: require(msg.sender == tx.origin)
  3. Whitelist restrictions on the target pair of margin trading.
  4. Whitelist restrictions on oracle price feeding permissions.

--

--

--

A lending protocol platform on Avalanche that bridges the gap between traditional financial users and crypto users. https://vee.finance/home

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Cryption Network: Weekly Update (17th January — 23rd January)

{UPDATE} Slot Car Race Hack Free Resources Generator

On Friday, a flood of ransomware hit hundreds of companies around the world.

Notification Channel Selection at WSO2 Identity Server

The Cuba Ransomware Gang

SpaceY 2025 $SPAY IDO and Community pools are Live on Red Kite! Let’s Apply Now!

S-Wallet values

{UPDATE} Tic-Tac-Toe-Classic Hack Free Resources Generator

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Vee Finance

Vee Finance

A lending protocol platform on Avalanche that bridges the gap between traditional financial users and crypto users. https://vee.finance/home

More from Medium

Multiple Protocol Monthly Update — December 2021

Building The Community and Listening To Our Advocates — Dexpools

Know Your Bankless DeFi Innovation Index (GMI) Token: Ribbon Finance (RBN)

Introducing Notional Bounties on Layer3