Radiant Capital hacked!!

4.5 million US dollars have been stolen today from a smart contract done by "Radiant Capital".

Here is the vulnerability:

	/**
	 * @dev Divides two ray, rounding half up to the nearest ray
	 * @param a Ray
	 * @param b Ray
	 * @return The result of a/b, in ray
	 **/
	function rayDiv(uint256 a, uint256 b) internal pure returns (uint256) {
		require(b != 0, Errors.MATH_DIVISION_BY_ZERO);
		uint256 halfB = b / 2;

		require(a <= (type(uint256).max - halfB) / RAY, Errors.MATH_MULTIPLICATION_OVERFLOW);

		return (a * RAY + halfB) / b;
	}

So what happened here? -- The function should just devide two values of the crypto currency RAY. The result is "rounded up", meaning: If the result is between two natural numbers representing RAY, but more than half way to the higher number, it jumps to the higher RAY. When this happens inside a loop, you gain a small portion in each iteration, and that could mount up to a reeeeeeeally high gain!! It was a flash loan attack, so during the flash loan, there were repeated calls to deposit() and withdraw() -- each time triggering the rounding.

Mission accomplished!! Wow!!! I would never dare to write a flash loan smart contract myself. There are way too many smart and wicked people out in the wild, just waiting ...