QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$6 300 000 USD
MAY 2021
GLOBAL
BELT FINANCE
DESCRIPTION OF EVENTS
Belt Finance is "[t]he conveyor Belt of optimized yield to your assets," "an AMM protocol incorporating multi-strategy yield optimization." "Belt.fi smart contracts are forked from yearn.finance, Curve, and Pickle Finance to combine the maximal benefits of the three." "The 4Belt BLP Pool is at its basis, a liquidity pool." An "audit was conducted by SOOHO, a CONSENSYS-backed blockchain security firm." Another "was conducted by HAECHI AUDIT." "Belt.fi is in beta. Please DYOR and use at your own risk." "Belt is a service designed for bringing peace of mind to its users."
"Belt Finance was attacked with a flash loan exploit and suffered damages to [their] funds, and more importantly, to the trust of our users." "A hacker exploited Belt Finance with a flash loan attack to steal over $6.2M BUSD. The attacker was able to manipulate the beltBUSD price by exploiting a balance calculation bug in the bEllipsisBUSD strategy contract."
"On May 29, 2021, a flash loan attack was initiated on the BSC 4Belt (USDT/USDC/BUSD/DAI) pool. The attacker created a smart contract that used PancakeSwap for flash loans and exploited our beltBUSD pool and its underlying strategy protocols and then proceeded to execute the contract 8 times for a total profit of 6,234,753 BUSD. beltBUSD vault users suffered a 21.36% loss of funds, while 4Belt pool users suffered a 5.51% loss of funds. No other pools/vaults were affected."
"The attacker acquired a flash loan of around 390 million BUSD from PancakeSwap for the exploit, which is close to the maximum amount of BUSD that could be garnered from all pools with BUSD on PancakeSwap. The attacker then deposited around 200 million BUSD of it into the beltBUSD vault (with Venus as the strategy protocol) so the ratio between strategies was shifted heavily towards Venus. Before the attack, the beltBUSD vault had a ratio split of around 60M BUSD in Venus, 60M BUSD in Alpaca, 60M BUSD in Ellipsis, and 20M BUSD in ForTube for a total of about 200M BUSD. The attacker’s deposit made it so that the Venus strategy had around 260M BUSD, so the total of beltBUSD was around 400M."
"The attacker’s contract simultaneously moved 190M BUSD to the Ellipsis.fi 3pool to exchange 190M BUSD to around 169.5M USDT. This swap resulted in a significant increase of the value of Ellipsis 3pool LP. The 3pool LP supply change did not change but this $21.5M difference went to increase the value of the 3pool LP by around 3%. This in turn increased the value of the Ellipsis strategy of the 4Belt pool 3% from 60M BUSD to 61.8M BUSD, raising the whole beltBUSD vault from 400M BUSD to 401.8M BUSD (a 0.5% gain)."
"The attacker then withdrew from the beltBUSD vault for a gain of around 0.5% on their 200M BUSD deposit, or about 1M BUSD (201M BUSD withdrawn from a 200M BUSD deposit). The attacker then swapped back the USDT to BUSD on Ellipsis, returning the LP to its previous value, and thus left the beltBUSD vault with a 1M BUSD loss."
"The attacker’s smart contract then repeated this cycle multiple times in this same transaction (as much the Tx gas limit maximum allowed), covering the flash loan fee and Ellipsis swap fees to eventually leave a profit. The attacker then took the BUSD profit to their address and swapped it to anyETH before using the Nerve Bridge to send their anyETH to the Ethereum Mainnet." "[T]he attackers managed to exploit this bug eight times before being detected."
Belt "paused withdrawals and deposits as soon as [they] were aware of the attack to prevent further losses and protect [their] users and their assets." "[B]eltBUSD pool’s loss was a total 50 million BUSD with the 43.8 million in fees added to the 6.23 million in profits taken by the attacker."
The platform most recently "sought to find a solution that would hopefully return the trust vested in us, by the way of compensating our users for our shortcomings." "A snapshot of the 4Belt pool and 4BELT token holders will be taken and users affected by the exploit will be airdropped the remedy4BELT (r4BELT) token in proportion to their 4Belt LP and/or beltBUSD holdings before the attack. The r4BELT token will be used as a tool to mark the users that were affected by the attack. Users affected by the attack can use their r4BELT to receive compensation over time." "From the team’s build allocation, 67% of the unlocked portion will be distributed to r4BELT compensation. This amounts to 864 BELT per day." "The BELT mining rate will stay the same but 15% of the distribution will now go to the 4BELT- r4BELT LP pool." "We are also committing $3 million USD to create a new BELT Buyback fund."
"The Belt Finance team is committed to reversing the damages incurred in regards to this recent incident, and remains committed to developing Belt Finance to be the best DeFi protocol possible." "Withdrawals from all pools/vaults are now open. We have taken the utmost caution in reviewing our code before reopening and have upgraded our monitoring tools. We are also having additional audits performed. We apologize for the inconvenience."
"Target timeline for the new compensation plan: 6/15 - Details on the new plan, 6/16 - New audit report, 6/18 - r4BELT token airdrop, 6/24 - Compensation begins". As of June 16th, Belt Finance completed an audit by SOOHO. "Affected users will receive the r4belt airdrop from the Belt team on June 18th."
The Belt Finance smart contract used the pricing information of their limited size market to determine the price of assets on the exchange liquidity pool.
A user borrowed a large amount of money via a flash loan, and used it to manipulate the price in a favourable way. The smart contract did what it was programmed to do, and provided that user with $6.3m in profit.
HOW COULD THIS HAVE BEEN PREVENTED?
In a smart contract environment, the use of a proper price oracle can prevent such exploits.
In general, an exchange platform could keep funds safer by placing the majority of them in an offline multi-signature arrangement. Smart contracts are effectively open source hot wallets.
CertiK Blockchain Security Leaderboard (Jun 1)
Belt.fi (Jun 13)
@BELT_Finance Twitter (Jun 15)
@BELT_Finance Twitter (Jun 15)
@BELT_Finance Twitter (Jun 15)
@BELT_Finance Twitter (Jun 15)
@BELT_Finance Twitter (Jun 15)
belt-contract/[ENG]BELTFI_Security_Assessment.pdf at main · BeltFi/belt-contract · GitHub (Jun 15)
belt-contract/HAECHI_AUDIT_Smart_contract_audit_report_for_BeltFi_earnV2_additional.pdf at main · BeltFi/belt-contract · GitHub (Jun 15)
Belt Finance Documentation - Understanding Belt (Jun 17)
4belt Compensation Plan (Jun 17)
May 29 Incident Report (Jun 17)
Belt Finance Victim of Flash Loan Attack in Latest Exploit of a BSC DeFi Protocol (Jun 17)
Binance Smart Chain Faces yet Another Flash Loan Attack: Belt Finance Loses $6.3 Million – Bitcoin News (Jun 17)
Profits from raiding Binance Smart Chain dapps in May (Jun 20)
SlowMist Hacked - SlowMist Zone (May 18)
belt-contract/[ENG]BELT_HECO_Security_Assessment.pdf at main · BeltFi/belt-contract · GitHub (Jul 7)
@BELT_Finance Twitter (Jul 7)
@autofarmnetwork Twitter (Jul 7)
@BELT_Finance Twitter (Jul 7)
@BELT_Finance Twitter (Jul 7)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
@frankresearcher Twitter (Aug 11)
@peckshield Twitter (Aug 11)
@mudit__gupta Twitter (Aug 11)
@cmichelio Twitter (Aug 11)
Knownsec Blockchain Lab｜Belt Finance Attack Event Analysis | by Knownsec Blockchain Lab | Medium (Aug 11)
Rekt - Belt - REKT (Aug 11)
Comprehensive List of DeFi Hacks & Exploits - CryptoSec (Jan 8)
Belt Finance Victim of Flash Loan Attack in Latest Exploit of a BSC DeFi Protocol - CoinDesk (Jan 8)
