BlockSec: Project @jaypeggerz hacked, lost about 15.32 ETH

According to BlockSec monitoring, the project @jaypeggerz was attacked and lost about 15.32 ETH (about $18,000). BlockSec described this as a contract-level reentrancy attack that successfully manipulated the price of JAY tokens. The JAY contract allows users to pass arbitrary ERC-721 tokens to the buyJay function. An attacker exploits this vulnerability to re-enter the JAY contract. Specifically, the attacker first borrowed 72.5 ETH for a flash loan, and then used 22 ETH to purchase JAY tokens. He then calls the buyJay function with another 50.5 ETH, passing a fake ERC-721 token. In the transferFrom function of the fake ERC-721 token, the attacker re-enters the JAY contract by calling the sell function to sell all JAY tokens. The JAY token price was manipulated because the Ethereum balance increased at the start of the buyJay feature. The attacker repeated the process twice in a single transaction, for a total profit of 15.32 ETH. Attack profits have been transferred to Tornado Cash.