April 10, 2022

Beosin: Analysis of the Attack on Gymdefi

On April 10, 2022, according to the Beosin-Alert, Gymdefi’s LiquidityMigrationV2 contract was exploited for about 1,327 WBNB. Beosin security team analyzed the incident and the findings are shown below.

Related Information

● Transaction hash: 0xa5b0246f2f8d238bb56c0ddb500b04bbe0c30db650e06a41e00b6a0fff11a7e5

● Exploiter’s address:


● Contract that launched the attack:


● Attacked contract:


Attack Process

  1. The attacker first withdraws 0.99655 BNB from Tornado.cash.

2. After deploying the attack contract, the attacker first borrows 2,400 WBNB from the WBNB-BUSD (0x58f8…dc16) transaction pool to the contract the attacker deployed in preparation for the subsequent steps.

3. Next, the attacker swaps 600 WBNB for 5,942,069.12 GYM in the GYM-WBNB (0x8dc0…91db) pool, then adds 1730 WBNB and 140W GYM to the GYM-WBNB pool to get 46,106.30 LP tokens.

4. After the liquidity is added, the attacker calls the migrate function in the LiquidityMigrationV2 contract through the attack contract to perform the migration. Since the actual prices of GYM and GYMNET tokens are not queried when the LiquidityMigrationV2 contract migrates, the amount of GYMs returned from the liquidity removal is directly passed in as the amount of GYMNETs added to the liquidity, and the attacker successfully swaps 46,106.30 LP (GYM-WBNB) tokens for 44,760.25 LP (GYMNET-WBNB) tokens.

5. The attacker then removes the liquidity and swaps the obtained 1,166,737.57 GYMNET for WBNB, and finally returns the flashloan and sends 1,327 WBNB to the exploiter’s own address.

Vulnerability Analysis

The attack mainly exploits a token swap design vulnerability in the LiquidityMigrationV2 contract. When performing migration, the migrate function in the contract uses the data returned when removing liquidity from the GYM-WBNB pool as a direct parameter of adding liquidity to the GYMNET-WBNB pool.

After borrowing a large amount of funds through the flashloan, the attacker maliciously controls the ratio of GYM to WBNB in the GYM-WBNB transaction pool. The migrate function is then called to swap 1,400,000 GYM for 1,166,737.57 GYMNET. Based on the GYM and GYMNET prices at the time of the attack, the ratio of GYM to GYMNET is approximately 130:1.

From the transactions in the contract, it appears that the contract was suspended 9 days ago. However, a large number of GYMNET tokens still remain in the contract, which just gives the attacker an opportunity to take advantage of it.

Fund Tracing

As of now, the stolen funds have not been transferred out and 1,327 WBNB remain in the exploiter’s address.


In response to this incident, Beosin security team recommends:

1. Contracts that rely on external contract data must do a good job of data validation during the development phase.

2. Before the project goes live, make sure to choose a professional security audit company to conduct a comprehensive security audit.

3. Project owners must do a good job of monitoring the status of the project. Be sure to transfer funds to a secure address promptly in case of contract abandonment or anomalies.

—END —

Beosin can provide professional security audit services. For more details, please visit our official website or contact us via Twitter, Discord or Telegram, etc.

If you have need any blockchain security services, please contact us:

Website Email Official Twitter Alert Telegram LinkedIn

Related Project

Related Project Secure Score

Guess you like
Learn More
  • Beosin Blockchain Security Ecosystem Overview in Q1 2022

    April 14, 2022

  • Beosin: Analysis of the Attack on StarStream

    April 08, 2022

  • Beosin: 10 Ways to Teach You How to Guard the NFT Assets

    April 08, 2022

  • The Analysis of Inverse Finance’s Price Manipulation Attack: The Hacker Profited About $15M

    April 03, 2022

Join the community to discuss.