Poolz suffers from arithmetic overflow attack, resulting in a loss of approximately $665,000

Recently, an attack incident targeting Poolz occurred on the Ethereum, Binance Smart Chain, and Polygon networks. According to on-chain data monitoring, the attack took place on March 15, 2023, at 3:16 AM ( UTC ). This attack involved multiple tokens, including MEE, ESNC, DON, ASW, KMON, POOLZ, etc., with total losses amounting to approximately $665,000.

The attacker exploited an arithmetic overflow vulnerability in the Poolz smart contract. Specifically, the issue lies in the getArraySum function within the CreateMassPools function. This function fails to properly handle the overflow situation caused by large number additions when calculating the initial liquidity provided by users for batch pool creation.

The attack process is as follows:

1. The attacker first exchanged a small amount of MNZ tokens on a certain decentralized exchange.

2. Then call the CreateMassPools function, passing in the carefully constructed parameters. The _StartAmount array contains two values: one is a large number close to the uint256 limit, and the other is a normal token amount.

3. Due to the overflow caused by the accumulation operation in the getArraySum function, the final return value is 1. However, the contract still uses the original _StartAmount value when recording the pool properties.

4. This caused the attacker to actually transfer only 1 token, but recorded a huge amount of liquidity in the contract.

5. Finally, the attacker calls the withdraw function to extract tokens, completing the attack.

To prevent such issues from occurring again, it is recommended that developers take the following measures:

1. Use a newer version of the Solidity compiler, as these versions will automatically perform overflow checks.

2. If it is necessary to use an older version of Solidity, you can introduce third-party security libraries to handle integer operations, such as OpenZeppelin's SafeMath library.

3. When processing user input, especially in scenarios involving large number calculations, strict boundary checks and exception handling should be performed.

4. Conduct regular code audits, with special attention to parts that may involve integer overflow.

5. Consider introducing mechanisms such as multi-signature or time locks to buy time for responses in emergency situations.

This incident reminds us again that security should always be the primary consideration in smart contract development. Even seemingly simple arithmetic operations can become a breakthrough point for attackers to exploit.