bscValueDefi-Exploit

Abusing delayed share calculations on 4000% APR staking (8 quintillion APY) on ValueDeFi Binance Smart Chain.

Example

Overview

• vFarm: Emission + Swap.
• vSafe: AutoCompounding using vFarm.
• earn(): Compound and recalculate share price.

earn() can be called by anyone and costs approximately 2$ in gas fees. Only upon earn() are share values calculated, but the underlying assets are growing each block. By remaining in vFarm just before earn() more than doubles the APY that can be had.

Usage

1. Encrypt/Obfuscate keys
   • Default: $ python utils.py <base64-target>
   • Encrypt with AES for VPS.
2. Configure config.json
3. Start with $ python earn.py
4. Profit.

Calculations

• The bearnfi strategy usually harvests strategy every 600 blocks unless user-called.
• Users call varies from time to time (check $ python scout.py).

Hence we estimate the block that earn() will be called, and park our assets in vFarm just in time. In practice the gas fees are so low that depending on capital and APR the fees will be recouped within a few blocks.

Structure

• earn.py - The algorithm.
• scout.py - Trimmed artifact of big-brain block prediction.
• utils.py - Utilites for encryption and profit calculations.
• .\bsc - Scripts for interacting with the EVM eg. deposit, withdraw...

Config

# VARIABLE     # TYPE (DEFAULT) : <DESCRIPTION>. 
------------------------------------------------------------------------
MYADDRESS      # STR  (None)    : Base64 encoded Public eth/bsc address.
SECRETKEY      # STR  (None)    : Base64 encoded Private eth/bsc key.
APIKEY         # STR  (None)    : Base64 encoded BscScan.com API key.
RISK           # FL   (1.05)    : Risk profile of missing user-called earn().
SAFEBASELINE   # UINT (1e18)    : Initial assets - deflationary.
FARMBASELINE   # UINT (1e18)    : Initial assets - inflationary.
GASTHRESHOLD   # UINT (3e15)    : Before swapping/harboring in vSafe.
MINTX          # UINT (1e5)     : Minimum transaction amount.
BUFFER         # UINT (160)     : Minimum earn() block distance.
AUTOCOMPLIM    # UINT (1e14)    : Not implemented.
AUTOCOMPOUND   # Bool (false)   : Not implemented.
VERBOSE        # Bool (true)    : Verbosity of prints.
ALARM          # Bool (false)   : Artifact. 4 second alarm at script termination. (IFTTT)
DEBUG          # Bool (false)   : Extra verbosity.
MAKER          # Bool (true)    : Force earn based on estBlock().

Considerations

Risk

It is advisable to lower the RISK if MAKER is false.

Baseline

The value in vSafe (SAFEBASELINE) is easily inferred from the amount of vSafe tokens, the same is not true for the amount of LP-Tokens within vFarm.

Hence we have the following:

• Undershoot SAFEBASELINE as it deflates upon earn() misses.
• Do not start earn.py with assets in vFarm unless correct value for FARMBASELINE in config.

References

• Platform
• vSafe Contract
• vFarm Contract
• Strat Contract

Change History

v1.0: Force earn() now 98% time in vFarm.

v0.3: Polynomial earn() block prediction with sin/cos cyclical input.