Analysis of the Liquidity Migration Attack Incident on Cellframe Network

On June 1, 2023, at 10:07:55 (UTC+8), Cellframe Network was hacked on a certain smart chain due to a token quantity calculation issue during the Liquidity migration process. This attack resulted in the hackers profiting approximately $76,112.

Event Analysis

The attacker exploited a computational vulnerability in liquidity migration. The attack process is as follows:

1. The attacker first acquires a large amount of funds through a flash loan, including 1000 native tokens of a certain chain and 500,000 New Cell tokens.
2. Exchange all New Cell tokens for the native tokens of a certain chain, causing the amount of native tokens in the pool to approach zero.
3. Exchange 900 native tokens of a certain chain for Old Cell tokens.
4. Before the attack, the attacker added liquidity of Old Cell and a certain chain's native token, obtaining Old lp.
5. Call the liquidity migration function. At this point, there are almost no native tokens of a certain chain in the new pool, and there are almost no Old Cell tokens in the old pool.

The migration process includes:

• Remove old Liquidity and return tokens to users
• Add new liquidity according to the new pool ratio

Due to the scarcity of Old Cell tokens in the old pool, the number of a certain chain's native tokens obtained when removing liquidity increases, while the number of Old Cell tokens decreases. This causes users to only need to add a small amount of a certain chain's native tokens and New Cell tokens to acquire liquidity, while the excess certain chain's native tokens and Old Cell tokens are returned to the users.

6. The attacker removes the liquidity from the new pool and exchanges the returned Old Cell tokens for the native tokens of a certain chain.
7. At this time, there are sufficient Old Cell tokens in the old pool, but a lack of the native token of a certain chain, allowing the attacker to exchange the Old Cell tokens again for the native token of that chain to profit.
8. Repeat the migration operation.

Summary and Suggestions

When conducting liquidity migration, it is essential to comprehensively consider the changes in the quantities of the two tokens in the old and new pools, as well as the current token prices. Calculating directly based on the quantities of the two tokens in the trading pair is prone to manipulation.

In addition, the project team should conduct a comprehensive security audit before the code goes live to prevent similar vulnerabilities from occurring. This incident underscores the importance of thorough security checks in Web3 projects, especially when involving complex financial operations.