The Tinyman Hack

On January 1st the Decentralised Finance platform built on Algorand network Tinyman was attacked and approximately $3 million of assets were withdrawn from a pool without authorization, according to their official blog statement.[1]

The attack was orchestrated by unauthorized users on some of Tinyman’s pools by exploiting a previously unknown vulnerability in the Tinyman contracts. The exploit resulted in a drain of certain ASAs in the first hours of attack which led to increased volatility in the immediate aftermath.[2]

Most Popular Asset Definition

• Top 25 Assets by Amount of Algo Swapped.
• Top 25 Assets by Number of Swaps

Analysis Methodology

This was a difficult analysis and took a while to connect the dots, but here is how it is all broken down.

• Asset_Id 0 is Algorand's native token Algo

• We are only considering transactions before BLOCK_ID 18363443, i.e MAX BLOCK_ID before the hack of 01-Jan-2022

• First we look at all the tx_group_id that have interacted with app_id = 350338509

• Then we filter out all transactions with the tx_group_id found above

• Now the challenge was there were transactions that weren't particularly swaps but just algo transfers, to filter out only the swap transactions here is the path chosen:

  • Rank all transactions filtered by tx_group_id and ordered by intra desc
  • The transaction with rank = 1 and Asset_Id !=0 is the Asset Algo transaction with the Asset information that was swapped to.
  • The transaction with rank = 2 and Asset_Id =0 is the Algo transaction with the Algo information that was swapped from.

• Create a pair from the Asset with rank = 1 and Algo

• Filter and select transactions only with Pairs that contain with word Tinyman since these are the ones we are concerned about.

Most Popular Assets by Number Swaps

Here is the list of the most popular assets sorted by the number of Swaps. USDC is the most popular asset Algo is swapped with by far as compared to other assets Algo is swapped with, even YLDY.

• Algo-->USDC with 78.5K swaps
• Algo-->YLDY with 28.8K swaps
• Algo-->USDt with 19.7K swaps

[1] https://ca.news.yahoo.com/defi-algorand-based-platform-tinyman-192231324.html

[2] https://tinymanorg.medium.com/official-announcement-about-the-incidents-of-01-01-2022-56abb19d8b19

Most Popular Assets by Amount of Algo Swapped

Here is the list of the most popular assets sorted by the amount of Algo swapped, YDLY aka Yieldly is the most popular asset Algo is swapped with by far as compared to other assets Algo is swapped with.

• Algo-->YLDY with 25.08M Algos swapped
• Algo-->USDC with 5.5M Algos swapped
• Algo-->OPUL with 2.6M Algos swapped

Does the average amount of Algo change based on asset

Looking at the chart below, the answer yes, the amount of Algo swapped varies quite a lot based on the Asset it was swapped for. For example, goBTC has an average of 1.7K algos swapped, whereas an asset like YLDY has only 870 algos swapped.

https://public.flourish.studio/visualisation/8368982/

https://public.flourish.studio/visualisation/8369017/