ChainCatcher has relayed a monitoring update from SlowMist, a blockchain security firm, stating that Atomic Protocol, a decentralized exchange, was attacked due to a signature replay vulnerability. The attack resulted in a loss of approximately 29,984 USDC. The vulnerability is attributed to contract 0xa806010f, where the signature digest does not bind the position ID, the position manager, the caller, the nonce, the deadline, and the chain ID. Due to this oversight, a single manager signature can be replayed across as many as 21 different position identifiers. The attacker combined this flaw with flash loan price manipulation to perform an unauthorized full destruction of LP tokens. Furthermore, the contract lacks TWAP (time-weighted average price) and slippage checks, meaning the protocol had no built-in mechanism to counteract manipulated prices during the transaction. The incident was reported by SlowMist and brought to public attention via ChainCatcher.
Atomic Protocol, a decentralized exchange, got hit by a signature replay attack on August 8, according to a ChainCatcher alert that cited SlowMist monitoring. Damage: about 29,984 USDC.
The bug sits in contract 0xa806010f. Its signature digest does not bind the position ID, position manager, caller, nonce, deadline, or chain ID. Because of that, the same manager signature can be reused across 21 different position IDs. Then the attacker leaned on flash loans to push prices around and pull off an unauthorized full destruction of LP tokens.
And the contract has no TWAP or slippage checks either. So there was no built-in defense against this kind of price manipulation.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
