Securing Web2 & Web3, auditing and penetration testing.
Menlo Park, CA
Joined November 2024
- Tweets367
- Following4
- Followers662
- Likes0
It seems @taraxa_project was hacked. The attacker minted 100 * 1e30 $TARA tokens (etherscan.io/address/0x2f42b…) in transaction etherscan.io/tx/0xa1301596c7…. Attacker address: etherscan.io/address/0x7bd73….
Meanwhile, it lost 4.3 ETH and ~6,000 USDT tokens (worth ~$14,600 total). The root cause is the unprotected function 0x6cd50a67 in the contract etherscan.io/address/0x359cf…, which allowed arbitrary transfers and mints.
more hack tx etherscan.io/tx/0x2074d4f995…, attacker etherscan.io/address/0x9c862…
An old contract named RIGHT (etherscan.io/address/0x02411…) was hacked and lost about 6.7 ETH (~$14K).
Tx: etherscan.io/tx/0x7b3878969c…
Attacker: etherscan.io/address/0x66d38…
Root cause is ............. re-entry. The most famous and popular one still. The sell() function does not clear the user's balance.
The other contracts created by the same deployer were attacked, too. TX etherscan.io/tx/0x1b28fdbf0a…
victim: etherscan.io/address/0xae4c2…
Another access control attack on the contract bscscan.com/address/0x1b6938…. Address bscscan.com/address/0x56b903… gained about $75k. Attacker: bscscan.com/address/0x4bf7c6…. Tx: bscscan.com/tx/0x1d8ebeb5a54…
The unknown function selector 0x83c7b8e4 allows transferFrom of any user who previously approved the $ETF token (bscscan.com/address/0xec7bac…) and swap with $USDT. In that transaction, 22 victims' $ETF tokens were attacked.
Attacker bscscan.com/address/0xf10395… gained more than $60K in tx bscscan.com/tx/0x827e23d6dc6…. The victim contract bscscan.com/address/0x46e185… lacks access control and blindly trusts user input, allowing it to transfer any user's $USDT who has given allowance. Please revoke the allowance ASAP!
There are two issues in the victim contract (bscscan.com/address/0x46e185…). The unknown function selector 0x6f73978a allows calling transferFrom on any account, forcing a swap of $OLY tokens (bscscan.com/address/0x544028…) and enabling the sandwich attack.
An old NFT contract, DoomCat (@doom_cats), was attacked and lost about 2 ETH (~$5k).
Attacker: etherscan.io/address/0xb84be…
Tx: etherscan.io/tx/0x58d57759c5…
2/ The attacker created 60 contracts and kept calling rescue() to force the victim contract to swap out more Heaven Gate ($HATE Token) while putting 5 WETH into the swap. This affects the K value, allowing the attacker to profit using a sandwich attack.
An old WADJET contract on BSC was hacked, losing about 111 BNB (worth $98k) in tx bscscan.com/tx/0x6ee0086b59b…. Attacker bscscan.com/address/0xdbdcc7… moved the assets to bscscan.com/address/0x8b6b00…, which seems funded by Rail BSC: Deployer (bscscan.com/address/0x76eb57…) @RAILGUN_Project.
An attacker (bscscan.com/address/0xa33af0…) attacked the new $HTC token using nearly 500 contracts and 37M gas. TX: bscscan.com/tx/0x9e1ea64cba6…. The token contract's awarding logic has an issue, leading to a $45K loss.
It seems like @EdenNetwork lost 12 ETH and 1.24M $EDEN tokens, worth about $54k in this tx: etherscan.io/tx/0xa5fde4dd2d….
The attacker (etherscan.io/address/0xd5dba…) called the vulnerable lockTokens() function, which allowed the contract to transferFrom any user account and assign an arbitrary startTime value.
An unknown contract (etherscan.io/address/0x0689a…) has an issue allowing users to pump the sharePrice and gain from its staking. It has another issue allowing transferFrom of $USDC from any account with allowance. Attacker (etherscan.io/address/0x2c2ec…) gained about $330k from the victim (etherscan.io/address/0x526c7…) in tx (etherscan.io/tx/0x3a8bde0a17…).
In the function collectInterestRepayment(), it allows transferFrom from any account that had allowance, and the sharePrice will be updated. An attacker could stake some tokens and then withdraw more after the price is inflated.
Another copy attacker etherscan.io/address/0xcafeb… walked away about $10k in this tx etherscan.io/tx/0xd462ce8921…