Project name: KLAYswap

Project type: Exchange

Date of exploit: Feb 3, 2022

Asset loss: Around $1.9M

Vulnerability: BGP Hijack

Date of audit report publishing: Nov 25, 2020

Conclusion: Out of Audit Scope

Details of the Exploit

Background

KLAYswap is a Defi project, providing token swapping and liquidity mining.

Nature of the Vulnerability

• It has been reported that KLAYswap was attacked by a BGP hijack. In this type of attack, the attackers manipulated the network flow and configured it in such a way that the users who were connected to KLAYswap could download malicious code from the server sent by the attacker instead of the normal Software Development Kit file or KakaoTalk. KakaoTalk is a popular South Korean instant messaging, marketing, and customer service application used by the cryptocurrency exchange platform.
• A BGP (Border Gateway Protocol) hijack is when an entity falsely claims to have the best route for Internet traffic to certain IP addresses. This can happen due to accidental misconfigurations or malicious intent. The consequences include misrouted internet traffic, potential for man-in-the-middle attacks, and possible internet downtime.

CertiK Audit Overview

N/A

Conclusion

On Feb 3, 2022, KLAYswap was attacked, leading to a loss of $1.9M. The attackers manipulated the network flow and configured it in such a way that the users who were connected to KLAYswap could download malicious code from the server.

The incident resulted from a BGP Hijack, unrelated to the smart contracts of KLAYswap.

References

BGP Hijacking: How Hackers Circumvent Internet Routing Security to Tear the Digital Fabric of Trust: https://www.certik.com/resources/blog/1NHvPnvZ8EUjVVs4KZ4L8h-bgp-hijacking-how-hackers-circumvent-internet-routing-security-to-tear-the

KLAYswap audit reports: ​​https://github.com/KlaySwap/klayswap