ElasticSwap Incident Analysis

ElasticSwap, an AMM for elastic supply tokens, was exploited in three flash-loan attacks that manipulated contract accounting (quoteTokenQtyToReturn based on current token balance) to drain approximately $850K from pools on Avalanche (and activity noted on Ethereum); the report provides a step-by-step attack flow, vulnerable contract analysis, attacker and transaction addresses, and documents that the team recovered a majority of funds (~55%) via a bounty and front-running bot.