Flashloan Detector 02.02 - Update

[RCantu92]

• Update to track the profit of the end recipient instead of the transaction initiator via looping through transaction traces in reverse
• Update bot tests to check for the destination address of a ERC20 Transfer event and native coin transfers
• Add new test for case when end recipient is not the transaction initiator
• Update tests to properly utilize traces
• Add labels property to findings
• Add coverage for Balancer and DODO flashloans

[Vxatz]

Trying to test the bot with this tx that we discussed, I get a false negative. That seems to be because, while the native profits are calculated correctly, when iterating through the back of Transfers, that last event that enters the for-loop and eventually breaks out of it, is the Log#5 from Etherscan which is an intermediate transfer from the "attacker"'s contract to Bancor: Converter.

It specifically enters the else if (name === "Transfer" && src.toLowerCase() === calledContract)which results in calculating the balance change of the Bancor: Convert in the const tokenProfits = helper.calculateTokenProfits(transferEvents, dst.toLowerCase());

I think that's happening because the last thing happening in the transaction (which results in the profit of the attacker) is the ETH transfer in the end.

A possible mitigation is to check if the last thing that happened in the transaction is an ERC20 or an ETH transfer. If it's the latter, then the bot shouldn't check the end recipient from the ERC20 transfer events. To do this, the bot could, for every txEvent, loop through the traces and check which of the following comes "later": a) a trace with trace.action.value, or b) a trace with trace.action.input.startsWith(transferSig) || trace.action.input.startsWith(transferFromSig).

[Vxatz]

The Balancer flashloan signature can be found in the transaction that was given as an example in the recently opened issue on this repo (tx link)

This seems a simple fix, basically creating a balancer-detector.jswith what is contained in the maker-detector.js, except changing the address tokento address indexed token (and then adding it to flashloan-detector.js)

On the same topic, there's an issue opened on our main repo, for which, while I think we don't need to change the Pancake's Large-Swap bot, we could also include that flashloan's signature to this bot as well.
The tx that the issue is referring to is this and the flashloan event can be found by searching for "DODOFlashLoan" in the Logs tab. This is a bit trickier, because in order to find the token that was flashloaned, we need to call _BASE_TOKEN_or/and _QUOTE_TOKEN_ on the address that emitted the event (DODO pool) for the non-zero amounts baseAmount/quoteAmountof the event.