The incident in question, courtesy of @RektHQ.

TLDR: AMMs like Spartan have to keep a record of how many tokens it owns in other smart contracts. If not coded in exactly the right way, that record could be manipulated. As an AMM on Radix has direct custody of all its tokens, there is no need for that record in the first place.

Spartan Protocol is a DeFi dApp for synthetic assets on Binance Smart Chain (BSC). Like Uniswap, Spartan allows users to swap between pairs of tokens using the liquidity provided by other users (“LPs”).

To provide that liquidity, LPs deposit a pair of underlying tokens, such as $SPARTA and $WBNB, into a “liquidity pool”. The LP then receives “LP Tokens” in return, representing their claim on their share of the pool. To get their pair of underlying tokens back, LPs burn their LP tokens by returning them to the pool. The exchange rate between the underlying tokens is calculated by the LP Token smart contract based upon the ratio of underlying tokens as per its internal records.

On May 1 2021, by depositing liquidity, sending more unsolicited tokens to the pools directly -  outside of the deposit liquidity process, and then withdrawing liquidity, a hacker took advantage of the way in which the LP Token smart contract updates its “Current Balance” (that internal record), so that it did not match the actual underlying tokens held by the liquidity pool in the $SPARTA and $WBNB smart contracts.

This allowed the hacker to drain the funds that were held in the LP Token smart contract prior to the hack, totaling approximately $30m of $SPARTA and $WBNB.

See here for a detailed technical write up of how the hacker was able to manipulate Current Balance.

So why couldn’t this hack happen on Radix’s upcoming Babylon release?

First, people can only send funds to a smart contract component via the functions/methods specified by the Scrypto developer. Sending unsolicited tokens to the pool could not happen on Radix.

Second, “Spartan” on Radix wouldn’t need to keep a record of how many tokens are stored in other contracts, as the tokens would live inside the vault of the “Spartan” component! This means the smart contract logic that would calculate the exchange rate has direct access to the actual underlying tokens, because the actual underlying tokens live in the “Spartan” smart contract.

Because of these two points, the attempted hack fails immediately, as there is nothing to exploit.

Not only does this make things more secure, as a smart contract developer, your workload is at least halved.

The best part is no part, as they say. If you’d like to learn more about Radix Engine and how it makes DeFi and your tokens on Radix far more secure, visit developers.radixdlt.com

For the last tweet thread in this series, check out Rekt Retweet #4 - Why your Bored Apes (and all other NFTs) aren’t safe… except on Radix

By Ben Fargher