CookFinanceIssuance exploit analysis

Cook Finance's issueWithSingleToken2 called the issuance module's general adapter with caller-supplied component weightings and a zero minimum-out for the underlying trades it made on the contributor's behalf. Whoever could seed a thin Pancake V2 component pool could therefore choose CKToken's issuance ratio, route the deposits through that pool, mint a controlled amount of CKToken, redeem the underlying components the issuance module had just acquired, and harvest the spread.

The attacker at 0xee18c4c2e123402731f43d680e75ca2809c30f8b seeded the affected Pancake V2 component pools with thin BNB, called issueWithSingleToken2 twice on the issuance module 0x7db3cbaf736c049933a3af28dbed4a4442aa89d0 with weightings that exploited the thin-pool depth, removed the LP it had just seeded, redeemed the recovered CKToken components for BNB, and exited.

DeFiHackLabs reports a total loss of about $50,000. The drain is in 0x51e46828b7aabfa810910b3f8ca535053716e6bcb8b7f94a4ff59757d71a1bca on BscScan.

What would have prevented it: a non-zero minimum-out on the per-component swap in the issuance adapter, computed against an external price reference rather than the spot pool. Or a caller-supplied-weighting cap such that component weights can only narrow, never widen, a pool's price range.