Team Finance hack — October 2022

On 27 October 2022 an attacker exploited Team Finance, an Ethereum service that locks liquidity pool tokens on behalf of token projects, through a feature that migrated locked positions from Uniswap v2 to Uniswap v3.

The migrate function on the Liquidity Locks contract did not properly validate what it was being asked to move. By first locking a token of their own to the contract, the attacker got past the validation and had the contract move real v2 liquidity into a v3 pair they controlled, priced at a ratio they had set. The gap between the liquidity deposited and the value of the position minted in the skewed pair was refunded to the attacker, who kept the difference. PeckShield put the cost of the initial attack transaction at about 1.76 ETH, roughly $1,600 at the time. Assets drained included DAI, USDC and ETH along with the tokens of projects that had locked liquidity with the service, among them CAW, TSUKA and KNDA.

Figures differ. Team Finance said $14.5 million of tokens were taken through the migration function. PeckShield's on-chain analysis later put the total at $15.8 million, including about $6.43 million in DAI and $1.3 million in ETH. The contract had been audited by Zokyo Security, whose auditors had raised concern about passing arbitrary addresses to the lockTokens function, which performs external calls, but did not identify the flaws that were used.

Team Finance paused the platform, said remaining locked funds were not exposed to the same bug, asked exchanges to blacklist the attacker's address, and invited the attacker to make contact for a bug bounty payment. Its total value locked fell from about $147 million to $127 million according to DefiLlama. No return of funds is documented in the sources consulted.