FEG
Hack or exploit on May 17, 2022 · Flash Loan Attack
What happened
The multi-chain DeFi protocol FEG was attacked again, and the flash loan attack suffered on the BNB chain lost about $1.3 million in assets. The subsequent flash loan attack on Ethereum caused a loss of about $590,000, with a total loss of about $1.9 million in assets. This attack is similar to yesterday's attack and is caused by a vulnerability in the "swapToSwap()" function. This function directly uses the "path" entered by the user as a trusted party without screening and validating the incoming parameters. Additionally, the function will allow an unverified "path" parameter (address) to use the current contract's assets. Therefore, by calling "depositInternal()" and "swapToSwap()", the attacker can obtain permission to use the assets of the current contract, thereby stealing the assets within the contract.
Details
- Date
- May 17, 2022
- Kind
- Hack or exploit
- Method
- Flash Loan Attack
- How in
- Price, oracle and governance
- Target
- not stated
- Chains
- Ethereum
Reported by
Related incidents
MooCakeCTX 2022 · Hack or exploit · $144K
ATK 2022 · Hack or exploit · $120K
fomo-dao 2022 · Hack or exploit · $110K
CUPID 2022 · Hack or exploit · $79K
SwanBluechip, "FEG hack, May 17, 2022: $1.9M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht47a4834419/ (data as of 2026-10-31).