Decoding Vowcurrency’s $1.2 Million Exploit

Exploit Overview

On August 13, 2024, an attacker exploited a vulnerability in the Vowcurrency Protocol, resulting in the loss of 175 ETH, 595,970 USDT, and 5,801,632 VOW tokens.

Attack Details

1. Rate Manipulation: The attacker changed the USD rate of VOW tokens from 1 to 100 and then back to 1.

2. Minting Advantage: This rate change allowed them to mint vUSD at a rate 100 times higher than normal.

• Financial Impact
  Swapped Assets: The attacker converted assets into 452 ETH (~$1.2M).

• Key Transactions
  Exploit Transaction
   
• Rate Change Transactions:
  Rate Change to 100
  Rate Change Back to 5

Attacker Details:

1. Attacker Address 1: 0x48de6bF9e301946b0a32b053804c61DC5f00c0c3
   Attacker Address 2: 0xbA1be907f532Ff6bb0088279e0f3DCDdD693aC7c
2. Attacker Contract: 0xB7F221e373e3F44409F91C233477ec2859261758
3. Victim Contract: 0x1BBf25e71EC48B84d773809B4bA55B6F4bE946Fb

On-Chain Details:

Attacker Address 1:
https://etherscan.io/address/0x48de6bF9e301946b0a32b053804c61DC5f00c0c3

Attacker Address 2: 

https://etherscan.io/address/0xbA1be907f532Ff6bb0088279e0f3DCDdD693aC7c

Attack Contract:
https://etherscan.io/address/0xB7F221e373e3F44409F91C233477ec2859261758

Vulnerable Contract:
https://etherscan.io/address/0x1BBf25e71EC48B84d773809B4bA55B6F4bE946Fb

Attack Transaction:
https://etherscan.io/tx/0x758efef41e60c0f218682e2fa027c54d8b67029d193dd7277d6a881a24b9a561
 

Private Key Exposure:

• Leakage: The private key of the usdRateSetter for the VOW Token was leaked, enabling unauthorized access and manipulation of rate settings.
   

Contract Deployment and Funding:

• Deployment: The attack contract (0xB7F221e373e3F44409F91C233477ec2859261758) was deployed 110 days prior to the attack.
   
• Funding: This contract was funded through Tornado Cash, a common tool for anonymizing crypto transactions.
   

Rate Manipulation:

• MEV Bot Role: An MEV bot, controlled by the attacker, was used to manipulate the vUSD rate. The bot changed the rate from 1 to 100, inflating the value of vUSD received per VOW token on Ethereum block 20519307.
  
  
• Minting vUSD: The attack contract then minted a large amount of vUSD at this inflated rate.
  
  
   

Token Swapping:

• Token Swapping: The attacker used the minted vUSD to swap approximately 26,107,347 VOW tokens for 175.4778 ETH and 595,970 USDT.

Rate Reversion:

• Reversion: After the exploit, the attacker reverted the vUSD rate back to its original value (1) on Ethereum block 20519316.
  
  

Final Outcome:

• Price Impact: Following the exploit, the VOW token price plummeted by 87%, now trading at $0.04.
• Attacker's Holdings: The attacker currently holds approximately 452 ETH, valued at ~$1.21M.