2021 Rari Capital Hacking Analysis

4 min readMay 22, 2021

This hacking happened on May 8 2021. The steal is about 2600 ETH(about 10M USD). Hacker uses dydx FlashLoan to attack RairCapital Fund Manager contract up to 91 times. Let’s see what’s going on.

Rari Capital Introduction

“Rari Capital, The smartest roboadvisor that ensures you receive the highest yield, far beyond just lending.” — from Cypherhunter. Rair Capital provides 3 pools to users, Stable Pool, Yield Pool and ETH Pool. ETH Pool is the hacked pool we are talking about today. Basically, Rari Capital is like yValut.

Attack Transaction Types

The first attack has happened on 2021/5/8 at 01:48:21 PM UTC. One attack includes two types of transactions, Work and Donate transactions. Work transaction is to change the Rari Capital pool token(RariFundToken) rate and uses FlashLoan to amplify the result. Donate transaction is to steal ETH and prepare the next attack. You can see Work and Donate transaction appear in pair.

Work Tx Main Flow:

FlashLoan Dydx
Deposit ETH to Rari pool
Send ETH to IbETH contract
Withdraw ETH from Rari pool

Donate Tx Main Flow:

Get RariFundToken balance
Withdraw ETH by using the remaining RariFundToken

Attack Tx Flow

Work Transaction:

Work Tx Step:

Hacker call ibEth.work(data)
ibETH call SushiswapGobin.work(data)
SushiswapGobin get strategy address and strategy data (ext) from decode(data)
SushiswapGobin call StrategyAddTwoSidesOptimal.execute(ext)
StrategyAddTwoSidesOptimal get fToken address from decode(ext)
StrategyAddTwoSidesOptimal get SushiSwap pool (fToken-Weth) information。That’s why the hacker need to create the pool(fToken-Weth) of shshiswap before hacking.
StrategyAddTwoSidesOptimal call fToken.approve(). Attack start!
fToken uses dydx flashLoan, withdraw about 5000 WETH from dydx pool
dydx call fToken.callFunction()
fToken get 5000 ETH through execute WET.withdraw()
fToken deposits 5000 ETH to RariFundManager
RariFundManager call RariFundController._getPoolBalance(pool) to get pool balance.
RariFundController call ibEth.totalETH() for alphaController.getBalance()
RariFundController calculate and return balance by the alphaController.getBalance(): (ibEth.balanceOf(Manager) * (_ibEth.totalETH())) / (_ibEth.totalSupply())
RariFundManager get fundBalance(controller balance and pool balance)
RairFundManager calculate RariFundToken Amount to user: reptAmount = (amount * reptTotalSupply)/fundBalance
Mint receAmount ReriFundToken to fToken
fToken send 1063 ETH to ibETH contract for increasing ibEth.totalETH()
fToken withraw 5000 ETH from RariFundManager
RariFundManager call RariFundController._getPoolBalance(pool) to get pool balance.
RariFundController call ibEth.totalETH() for alphaController.getBalance(). But ibEth.totalETH() has been increased by step18.
RariFundController return balance. The balance is increased because _ibEth.totalETH() has been increased.
RariFundManager executes getPEPRBurnAmount() to calculate how much RariFundToken needs to be burned. reptAmount = (amount * reptTotalSupply)/fundBalance. reptAmount will be decreased because fundBalance has been increased. That means to withdraw the same ETH amount by burning a few RariFundToken.
Burn RariFundToken
Send ETH to fToken
fToken swap ETH to WETH
fToken deposit ETH to dydx pool (payback). fToken.approve() Finish.
The end of the ibEth.work() will return excess ETH to the sender. It will return 1063 ETH in step18 to the hacker

Donate Transaction:

Donate Tx Step:

Hacker call fToken.donate() with ETH value. ETH value is preparation for next attack.
fToken call FundManager.balanceOf() to get how much ETH can be withdrawn.
fToken call FundManager.withdraw to withdraw ETH using remaining RariFundToken.

Related Txs and Contracts:

In Blockchain, contract interaction is straightforward and common. But with the Defi combination, the potential risk is also up. The root cause of hacking is the issue of integration between Defi Protocols. Both Alpha Protocol and Rari Capitialrun run well individually, but the problem comes up when they integrated. We should be more careful about the integration of Defi protocols. Especially every hacking bring lots of damage to lose in Blockchain.