2022.12.13 - ElasticSwap

On December 13, 2022, ElasticSwap, an Automated Market Maker (AMM) platform that focuses on elastic supply tokens, suffered an exploit on both Ethereum and Avalanche, resulting in the loss of approximately $854K. The root cause of the hack was a price oracle manipulation, which was made possible due to a difference in the calculation of pricing in the AMM algorithm between adding and removing liquidity. The exploit transaction on Ethereum was front-runned by a different exploiter address, that paid to the miner in order to get its transaction first in the block. The front-runner exploiter gained around 445 ETH, from which 400.5 ETH were returned, and the rest remained as a bounty. The stolen funds on Avalanche (22,454 AVAX) remained in one of the attacker's wallets.