BlockSec Phalcon: Sharwa Finance was attacked, resulting in a loss of approximately $146,000.

According to a report from 深潮 TechFlow on October 20, monitored by the blockchain security firm BlockSec Phalcon (@Phalcon_xyz), the decentralized finance protocol Sharwa Finance was attacked and subsequently suspended operations. Hours after the attack, several suspicious transactions continued to exploit the same vulnerability through slightly different attack vectors.

The attacker first creates a margin account, then uses the provided collateral to borrow additional assets through leveraged lending, and finally executes a clip attack on the exchange operation involving the borrowed assets. The root of the vulnerability lies in the MarginTrading contract's swap() function, which lacks solvency checks; it only verifies the solvency of the account status before executing the asset exchange.

The two attackers made a profit of approximately $146,000 in total, with Attacker 1 (0xd356…c08) earning about $61,000 through multiple attacks, and Attacker 2 (0xaa24…795) making approximately $85,000 from a single attack.