FANTASM FINANCE

DESCRIPTION OF EVENTS

"Dear Fantomians, we’re excited to announce the launch of Fantasm Finance!" "Welcome to Fantasm. Fractional-Algorithmic Synthetic Token pegged to the value of 1 FTM on Fantom Opera."

"Fantasm Finance is a DeFi project aimed at developing and popularizing synthetic tokens for the Fantom Ecosystem. Imagine having exposure to the price of FTM token without actually owning it. That’s not fantasy: it’s #Fantasm."

"With Fantasm Finance we introduce a decentralized solution to scale up volume of the FTM token by using our partial collateralized design where synthetic token supply of xFTM will be partially backed by FTM and partially by the FSM token. xFTM is a Fractional-Algorithmic Synthetic Token pegged to the value of 1 FTM on Fantom Opera."

"xFTM is a synthetic token pegged to the price of the FTM cryptocurrency on the Fantom Network. It is a fractional-algorithmic synthetic token pegged 1:1 to the dollar value of 1 FTM. In other words, the price of 1 xFTM equals 1 FTM."

"On March 09, starting at approximately 02:00 p.m. UTC, suspicious transactions related to the Fantasm protocol which resulted in a loss of $2.62M."

"The Exploiter [got] funds from BNB Chain via Tornado Cash", swapped "BNB to USDC via Pancakeswap", and "USDC to Fantom via Celer Bridge". "The Exploiter receive[d] USDC from Celer Bridge" and "FTM from a faucet". They then "Swap[ped] USDC for more FTM" and "deploy[ed] a contract [to] trigger the exploit".

"That contract exploited the error in Fantasm’s Pool contract where the developer missed the condition checking for the minimum amount of input FTM when minting XFTM." "This contract deployed by Exploiter repeatedly [minting] XFTM by input only FSM token without entering any FTM, collect[ing] XFTM token, [selling] XFTM token to FTM, buy[ing] more FSM and repeat the first step to get a larger amount of FTM."

"After exploiting the vulnerability, the hacker exchanged all the profits for ETH, and used Tornado.cash to mix coins across the chain to the Ethereum main network. According to statistics, the hacker made a profit of 1,007 ETH (about 2.73 million US dollars)." "Eventually, the exploiter sold all his FTM for ETH and bridged these ETH to Ethereum, again via Celer Bridge. The total amount exploited is 1008.498875252390151 ETH (approximately $2,622,097)"

"Fantom’s on-chain synthetic asset protocol, Fantasm Finance, posted on social media that its FTM collateral reserves had been exploited, and called on users to exchange their XFTM immediately."

"URGENT ANNOUNCEMENT : Redeem your XFTM. Our FTM collateral reserve has been exploited, there is still 1,820,012 FTM pool balance remaining currently for redemption." "Please also exit from liquidity pools."

"Update: Some of the FTM collateral reserve has been whitehacked."

"[W]e apologize for the exploit event which just happened. A Post Mortem with compensation options will be published by tomorrow. We are analyzing the exploit right now. Most sincere apologies once again."

Fantasm Finance "performed a forensics analysis to provide more insight into transactions and actions taken by the exploiter."

"We have patched the vulnerability and shared the newly committed code with our auditor."

"[W]e have 935,415 FTM from white hacking the protocol ourselves once we became aware of the exploit. We will return this to users via a snapshot compensation at block height 32970600. This part will be returned to XFTM holders." "935k whitehacked FTM will be evenly distributed on Friday 18th to all XFTM holders during the snapshot. Under the Compensation Tab you can see your XFTM & FSM holdings at snapshot. There were around 4.9m XFTM at that time."

"We once again deeply apologize for the inconveniences caused by this. We encourage the attacker to reach out to the Fantasm team and begin a dialogue for the return of our users’ funds. They are impacting everyday users of DeFi and we would like them to do the right thing. We will honor a bug bounty of 10% upon returning of funds."

Fantasm Finance is a protocol creating a synthetic token which is 1:1 pegged against the Fantom token. Due to a missing condition check for the minimum amount of fantom, the smart contract hot wallet was vulnerable. A malicious user exploited this and made off with over 1,007 ETH from the hot wallet. Some remaining funds were whitehacked by the protocol team, and dietributed to users. While the hacker has been made an offer, and there is some suspicion of who they are, no offer to return the funds appears to be on the table, nor has the Fantasm team come forward, so it appears that affected users bear the full impact of the breach.

SlowMist Hacked - SlowMist Zone (Jun 26)
https://coinmarketcap.com/currencies/ethereum/historical-data/ (Dec 21)
Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera (Mar 16)
About Fantasm Finance - Fantasm (Mar 16)
@fantasm_finance Twitter (Mar 16)
@fantasm_finance Twitter (Mar 16)
Fantasm Finance - Fractional-Algorithmic Synthetic Token on Fantom Opera (Mar 16)
@fantasm_finance Twitter (Mar 16)
@fantasm_finance Twitter (Mar 16)
@fantasm_finance Twitter (Mar 16)
@fantasm_finance Twitter (Mar 16)
Address 0x47091e015b294b935babda2d28ad44e3ab07ae8d | FtmScan (Mar 16)
https://medium.com/@fantasmfinance/fantasm-finance-to-launch-synthetic-assets-on-fantom-ff31f954f5d (Mar 16)
https://medium.com/@fantasmfinance/the-fantasticdao-and-expansion-plans-fda82b6cc82 (Mar 16)
https://medium.com/@fantasmfinance/fantasm-finance-post-mortem-exploit-09-march-2022-daf48ead016f (Mar 16)
https://bscscan.com/tx/0x11407dd11dd028cfefdb24c9bde9163b4d10e3338e62c74ae2f5f3c2ec863133 (Mar 16)
https://bscscan.com/tx/0xeffe3e64b2df1e80d5282a55bd12a7e89cd088616d85274bb1589b3b96526f28 (Mar 17)
https://bscscan.com/tx/0xe47bd66738fd6721817ebc68cfdfde19d860330cc8b84bdf6761a3f1957ef188 (Mar 17)
https://bscscan.com/tx/0x2b5f61778881958d98935cdfcbcb97a7de8405b1d059c931f02461776ad9e007 (Mar 17)
Fantom Transaction Hash (Txhash) Details | FtmScan (Mar 17)
Fantom Transaction Hash (Txhash) Details | FtmScan (Mar 17)
Fantom Transaction Hash (Txhash) Details | FtmScan (Mar 17)
Contract Address 0x944b58c9b3b49487005cead0ac5d71c857749e3e | FtmScan (Mar 17)
https://etherscan.io/address/0x47091E015b294B935BAbDA2d28aD44e3Ab07ae8D (Mar 17)
https://beincrypto.com/fantasm-finance-loses-2-6-million-defi-exploit/ (Mar 17)
@PeckShieldAlert Twitter (Mar 17)
@nipun_pit Twitter (Mar 17)
Fantom's DeFi Fantasm Finance (FSM) Exploited; $2.6 Million Lost (Mar 17)
Fantom Based Protocol Fantasm Suffers 2 6m Exploit (Mar 17)
Fantom Transaction Hash (Txhash) Details | FtmScan (Mar 20)

More case studies

Pirate X Pirate
Private Key Leak

Unchained Capital
ActiveCampaign Privacy Breach