Revisiting The Redemption Flashloan Attack

On April 18, 2022 a coordinated flash-loan attack exploited a design flaw in the RedemptionPair (a modified Uniswap V2 pair) that allowed repeated flash-loan operations to remove tokens from the pool, artificially inflate the 2OMB price in the Redemption LP, and extract approximately 4 million 2OMB (~$1.6M). The report provides transaction-level analysis, identifies the root cause (controller fee paid after the K invariant check and a zero/default feeAmount), and enumerates affected LP contracts—issues that would likely be detected in a targeted audit of the nonstandard pair implementation.