Security Team: EGD_Finance Was Hacked, and Token Prices Were Manipulated by Flash Loans

The EGD_Finance project on BSC was hacked, resulting in the unexpected withdrawal of funds from its pool. The analysis performed by the SlowMist security team is as follows:

1. Because the claimAllReward function in the EGD_Finance contract that obtains the reward will call the getEGDPrice function to calculate the price of EGD when calculating the reward, and the getEGDPrice function only calculates the price of EGD by dividing the balance of EGD and USDT in the pair.
2. The attacker uses this point to first flash a lot of USDT in the pool, so that the price of the EGD token becomes very small after calculation. Therefore, when the claimAllReward function is called to obtain the reward, the reward will be calculated more. As a result, the EGD tokens in the pool were unexpectedly withdrawn. This incident is because the price-feeding mechanism for calculating the rewards when the EGD_Finance contract obtains the rewards is too simple, resulting in the token price being manipulated by the flash loan for profit.