Crypto deception exposed: Check Point Research reports manipulation of pool liquidity that causes token price to skyrocket by 22,000%.

By Oded Vanunu, Dikla Barda, Roman Zaikin

Uncovering Fraudulent Tactics: A recent investigation from Check Point Research uncovers a worrying trend in the cryptocurrency landscape. Fraudulent actors manipulate pool liquidity, causing token prices to rise by a shocking 22,000%.

$80,000 Heist Uncovered: Pool liquidity manipulation resulted in a quick and calculated theft of $80,000 from unsuspecting token holders. This incident sheds light on the evolving strategies fraudsters use to exploit decentralized finance platforms.

Continuation of the threat situation: This incident immediately follows a previously reported million-dollar fraud. Check Point Research recently delved into the intricacies of a carpet heist orchestrated by a fake token factory. For details on this previous incident, see Check Point Research: Unraveling the Rug Pull.

Check Point’s Blockchain Threat Intelligence system triggered a pool liquidity manipulation alert, resulting in a staggering 22,000% token price surge. The malicious actor took advantage of the liquidity pool and stole $80,000 from unsuspecting holders.

Check Point's Blockchain Threat Intelligence system detected a malicious transaction:
https://etherscan.io/tx/0x85ebb1b1d6f091a2d72c4cffb66beea0552a07b2efabb5fd53d4198f8d159b64

What have we found?

The scammer created two wallets:

1. 0x48F7661E84A823505d683D092a2DccdA1e5aA119
2. 0x151a2498826F9fe6f214C92bB1811f7d1153b630

With the first wallet, they deployed the contract token WIZ (0x2ae38b2b47bf41ba4ab8f749b092fdd02b00bc1e) and its liquidity pool pair address (0x6e0367d897a8fd8bcbc44b4e2a14bafa904360aa), which contained reserves of WETH and WIZ tokens . In the second wallet (0x151a2498826F9fe6f214C92bB1811f7d1153b630), the scammer created a malicious contract (0x796042E0032aC5247bc04A49102d49c5b5A5cF0c) that aimed to exploit a backdoor and increase the WIZ token price tampering resulting in a cost of $80.00 0 theft from victims.

Functionality:

1. Token creation: The scammer introduces a new cryptocurrency token, pegs it with a well-known cryptocurrency on a decentralized exchange (DEX), thereby creating a liquidity pool.
2. Token promotion: Aggressive marketing, often using social media and influencers, creates hype and attracts investors.
3. Investor participation: As investor interest grows, they start purchasing the new token.
4. Pool manipulation: After amassing significant investments, the scammer manipulates the pool reserve by destroying most of the WIZ tokens, reducing the supply and temporarily increasing the token's price by 22,000%.
5. Cheater's winnings: Taking advantage of the inflated price, the scammer sold a significant number of tokens and pocketed $80,000.

Technical Insights:

Liquidity pools

In the world of cryptocurrencies, you often need to exchange one type of digital currency for another. But how can you do this quickly and easily without any intermediate steps? This is where liquidity pools come into play. Without these pools, you would have to find someone willing to trade at the exact time and price you want, which can be difficult and time-consuming.

So how does a liquidity pool work?

Let's break down the mechanics of a liquidity pool:

Imagine a large digital reservoir containing two different cryptocurrencies – let’s call them Token A and Ethereum. This reservoir serves as an open arena where anyone can exchange Token A for Ethereum or vice versa.

Now, when a person decides to exchange Token A for Ethereum, they contribute Token A to the pool and withdraw the corresponding value of Ethereum. Dynamic pricing within the pool fluctuates depending on the quantity of each token present. If there is an abundance of Token A but a shortage of Ethereum, the value of Token A decreases while the value of Ethereum increases.

In the present case, the fraudster manipulates the pool balance by burning tokens. Burning tokens within a liquidity pool such as the WIZ/WETH pool can increase the value of the token by adhering to the basic principles of supply and demand. As tokens are permanently removed from circulation, the overall supply is reduced.

Liquidity pools follow a formula that harmonizes the amounts of two tokens. When one token type (in this case WIZ) is reduced by burning, the relative value of the other token (WETH) in the pool increases to maintain balance. Failure to increase the amount of WETH will result in a significant increase in the token price, especially for WIZ.

Do you see hackers or scammers exploiting this method, called liquidity pool manipulation, to influence token prices?

The essence of this strategy lies in the temporary inflation of the token price within the liquidity pool. Given that decentralized exchange (DEX) prices depend on the assets in the pool, depleting one side (through burning) can distort the price.

Liquidity pools become vulnerable to exploitative tactics, including rug pulls or influencing contracts that rely on these pools for price data. This blog focuses on the former and unravels the story of a scammer who hides a backdoor to manipulate the WIZ/WETH liquidity pool by burning his tokens. So let's see what the scammer did:

The scammer runs the “brr” methodID (0x5606de36) function on his malicious contract:

Let's look at this function:

We can see in line 127 that the impostor is executing the transfer function on the _coin contract address. The _coin address is set to the WIZ address by the scammer in a previous function: 0x2ae38b2b47bf41ba4ab8f749b092fdd02b00bc1e

Using this transfer function, the scammer was able to burn the WIZ tokens in the pool. Let's understand how:

To get to the _burn function, the cheater must pass a few checks, which we will now examine:

The first check he needs to do is “limitsEnabled”. This should have been set to “False” so that the fraudster could proceed to the second check.

In order for limitsEnabled to be False, the scammer had to run the removeLimits function.

And as we can see, just before giving up ownership of the WIZ contract, he calls this function:

So the fraudster passes the first test.

Now let's look at the second test. The sender address must return False for ExcludeFromFees and True for isexcludedForMaxTxAmount.

Since both functions _isExcludedFromFees and _isExcludedForMaxTxAmount are public, we can run them with the scammer's contract address as input and check the results:

Let's look at how the malicious contract address for ExcludedForMaxTxAmount was set to True as this is the part that helps us understand that the person who created the WIZ token and the scammer are the same person.

We found a backdoor in the WIZ contract code. The scammer hardcoded the malicious contract address in the code as mktRecevier and set the excludeFromMaxTranscation option to True for this address:

This helps the cheater pass the second check and allows them to get to the _burn function.

He then uses this function to burn the WIZ tokens in the WIZ/WETH liquidity pool.

If we look further at the malicious contract code:

We can see that on line 132 of the malicious contract, the scammer synchronizes the pool and increases the WIZ price. Then at the end on line 137 0xf77 is executed, which sells all the tokens and steals almost $80,000.

As you can see in CoinMarketCap, the price of the token increased by 21949% at the time of this malicious transaction:

Scammer's strategy:

The scammer's approach is to temporarily increase the token price in the liquidity pool. By manipulating the pool balance, they influence decentralized exchange prices. Liquidity pools that are integrated into different contracts become vulnerable to manipulative schemes.

Diploma:

This manipulation scheme highlights the vulnerability of liquidity pools to fraudulent activities. Scammers are using backdoors and exploits to manipulate token prices, highlighting the importance of vigilance in the decentralized finance space.

Check Point researchers are actively monitoring domains associated with the identified fraudster's wallet address and the like. The Threat Intel Blockchain System developed by Check Point continues to collect valuable information about emerging threats and this information will be shared in the future. With this collaboration, we aim to provide investors with the knowledge they need to confidently navigate the crypto space and protect themselves from potential pitfalls. For further information contact us at: [email protected]

Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers