s0sta

IT Manager — Linux · Netzwerke · 600 User
Web3-Sicherheit: Smart-Contract-Audits · DeFi-Exploits
EU Blue Card eligible

[s0sta @s0sta_]

BDEX — logic (public harvest on skewed reserves)
2022-11 · BSC

THE INCIDENT
The attacker deposits 34 WBNB into the BDEX pair and manually swaps out BDEX, then calls the vault strategy's `convertDustToEarned()` which harvests against the skewed reserves, and sells the BDEX back for more WBNB than spent.

THE LESSON
Public harvest/convert functions that read live pool reserves can be triggered at attacker-chosen skew moments.

Full analysis: https://t.co/uHdUNwq4Ja

#LogicFlaw #SmartContract #DeFi #Security

[s0sta @s0sta_]

Annex — access-control (liquidation helper executes attacker swaps)
2022-11 · BSC

THE INCIDENT
The attacker deploys a worthless token, adds its LP with 8 flashloaned WBNB, then flash-swaps WBNB into the Annex `Liquidator` contract, whose logic (triggered by the swap) grants the attacker a transferFrom; the attacker pulls the liquidator's WBNB balance and removes liquidity.

THE LESSON
Liquidation helpers that react to attacker-supplied pair swaps can be coerced into transferring out their own funds.

Full analysis: https://t.co/MVDOmdkNIW

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

AUR — access-control (public reward setters)
2022-11 · BSC

THE INCIDENT
`changeNodePrice` and `changeRewardPerNode` on the AurumNodePool are public; the attacker sets both to astronomical values, creates a node, rolls/warps time forward and claims the inflated node reward, then dumps AUR for BNB.

THE LESSON
Node-reward rate and price setters must be owner-only — public setters turn rewards into faucets.

Full analysis: https://t.co/NMT9ak1n4B

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

VTF — reward logic (fresh-address claims) + flashloan
2022-10 · BSC

THE INCIDENT
The attacker deploys 400 `claimReward` contracts via create2, flashloans 100k USDT, buys VTF and transfers it to the first contract, then chains `claim()` calls through all 400 — each fresh address's `updateUserBalance` grants a full first-time reward, multiplying the payout, which is finally sold back for USDT.

THE LESSON
Fresh-address reward resets are farmable in bulk with factories — bound rewards by total stake, not per-address timestamps.

Full analysis: https://t.co/apYcASrFN5

#FlashLoan #DeFi #SmartContract #Security

[s0sta @s0sta_]

UERII — access-control (public mint)
2022-10 · Ethereum

THE INCIDENT
`https://t.co/I7MTgUqdHr()` has no access control, so the attacker mints a large amount and swaps it for USDC then WETH via Uniswap V3 (~$2.5k).

THE LESSON
Check every mint function for `onlyOwner` — an unguarded mint is instant value extraction.

Full analysis: https://t.co/nbzOupJWnU

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

ULME — ULME_exp2.sol — access-control (buyMiner spends third-party allowances) + flashloan
2022-10 · BSC

THE INCIDENT
Same ULME incident with 7 chained DODO flashloans: each callback borrows from the next pool, then the attacker swaps USDT→ULME, calls `buyMiner(victim, allowance*10/11)` for all 101 victims, swaps back and repays the chain of loans.

THE LESSON
Same lesson as ULME_exp.sol — third-party allowance spenders need caller auth.

Full analysis: https://t.co/SWtfCPUj1A

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

TransitSwap — access-control (owner validation via crafted calldata)
2022-10 · BSC

THE INCIDENT
The swap router's calldata allowed specifying an arbitrary "owner" that the claimTokens helper (0xed1a…) used for `transferFrom`; the attacker crafts calldata naming an innocent user who had pre-approved the helper and pulls that user's BUSD to themselves ($21M+ across chains).

THE LESSON
Claim/withdraw helpers must derive `from` from msg.sender or a verified signature — caller-supplied owner fields are drains.

Full analysis: https://t.co/t7Ii0pHrrR

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

TempleDAO — access-control (missing auth on migrateStake)
2022-10 · Ethereum

THE INCIDENT
`StaxLPStaking.migrateStake(oldStaking, amount)` was public with no ownership check; the attacker passes their own contract as `oldStaking` and mints themselves the staking contract's entire xFraxTempleLP balance, then `withdrawAll(false)` (~$2.3M).

THE LESSON
Migration entry points must verify the source staking position belongs to the caller or is whitelisted.

Full analysis: https://t.co/ppMwHOlFga

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

RL — airdrop logic (fresh-address payouts)
2022-10 · BSC

THE INCIDENT
The attacker pre-deploys 100 `AirDropRewardContract`s via create2, flashloans 450k USDT, buys RL and adds LP, then calls `distributeAirdrop(each fresh contract)` — the airdrop pays every address with no eligibility snapshot — and removes liquidity to repay.

THE LESSON
Airdrops without a snapshot or eligibility bound are farmed by contract factories — payout must be bounded per identity.

Full analysis: https://t.co/rbt9zo2IZt

#FlashLoan #DeFi #SmartContract #Security

[s0sta @s0sta_]

RES — RES_exp2.sol — tokenomics (thisAToB conversion) + victim-drain
2022-10 · BSC

THE INCIDENT
Alternative PoC for the same RES incident: flashloans from two DODO pools, buys RES into a create2-deployed receive contract (to pass `isContract` checks), calls `thisAToB()`, then sells the victim's RES and ALL tokens directly against the pairs with manually computed amounts.

THE LESSON
Same lesson as RES_exp.sol — conversion entry points and contract-address checks are bypassable with create2 factories.

Full analysis: https://t.co/MxlfR41pVQ

#FlashLoan #DeFi #SmartContract #Security

[s0sta @s0sta_]

Olympus DAO — access-control (fake bond token validation)
2022-10 · Ethereum

THE INCIDENT
`BondFixedExpiryTeller.redeem(token_, amount_)` trusts the supplied token's `underlying()`/`expiry()` without checking it's a registered bond; the attacker deploys a FakeToken claiming `underlying == OHM`, then redeems the teller's entire OHM balance (30,437 OHM).

THE LESSON
Redeem/claim functions must verify the asset against a registry — never trust metadata from the token being redeemed.

Full analysis: https://t.co/xLlIqBmzn1

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

Multicall (unnamed) — access-control (arbitrary external calls)
2022-10 · Polygon

THE INCIDENT
The contract's `multicallWithoutCheck` executes arbitrary `(target, callData, value)` with no whitelist; since the contract holds USDT, the attacker multicalls `USDT.transfer(attacker, balance)` and drains it entirely.

THE LESSON
Multicall implementations without a target whitelist or auth are self-service drains for anyone.

Full analysis: https://t.co/e07wrovcnO

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

https://t.co/6mSPqwl6VR (MAI) — oracle manipulation + read-only reentrancy (Curve)
2022-10 · Polygon

THE INCIDENT
With Aave/Balancer flashloans of WMATIC/stMATIC, the attacker adds liquidity to the stMATIC/WMATIC Curve pool, deposits LP into Beefy and mints collateral in https://t.co/6mSPqwl6VR, then `remove_liquidity` triggers `receive()` which borrows 250k miMATIC against the now-pumped collateral price; a second contract self-liquidates the position with that miMATIC, capturing the collateral.

THE LESSON
Curve's `remove_liquidity` ETH refund callback re-enters price reads mid-tx — protect against read-only reentrancy around oracle-dependent borrows.

Full analysis: https://t.co/WQi0bBVlc6

#Reentrancy #SmartContract #DeFi #Security

[s0sta @s0sta_]

MEV Bot 0xa47b — access-control (untrusted flashloan userData)
2022-10 · Ethereum

THE INCIDENT
The bot receives a Balancer flash loan whose attacker-controlled `userData` encodes a swap path; the bot's callback executes the embedded swap with the attacker's address as recipient (the PoC rewrites that field), and the attacker swaps the drained USDC to WETH — 187.75 WETH total.

THE LESSON
Flash-loan callbacks must validate/ignore `userData` destinations — never let embedded calldata pick the recipient.

Full analysis: https://t.co/HVl1qujxoc

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

INUKO — oracle manipulation (bond price off pair) + flashloans
2022-10 · BSC

THE INCIDENT
The attacker adds INUKO/USDT liquidity to get LP tokens, chains flashloans across 8 DODO pools and Venus markets to pump the INUKO/USDT pair reserve, then `buyBond` prices the bond off those reserves and sells/claims INUKO after the price reverts.

THE LESSON
Bond purchase prices read from spot reserves are flash-loanable — require TWAP or fixed pricing.

Full analysis: https://t.co/g5HZhkGUwF

#OracleManipulation #DeFi #SmartContract #Security

[s0sta @s0sta_]

HPAY — access-control (public reward-token setter)
2022-10 · BSC

THE INCIDENT
`BONUS.setToken(address)` was public; the attacker deploys a worthless self-minted SHITCOIN, stakes it, rolls 1000 blocks, then switches the reward token to HPAY and withdraws rewards computed for 30M HPAY, dumping for ~115 BNB.

THE LESSON
Reward-token configuration setters must be owner-only — swapping the reward asset is how stake contracts get drained.

Full analysis: https://t.co/k4muYXQota

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

EFLever Vault — oracle manipulation (balance-based share price) via flashloan
2022-10 · Ethereum

THE INCIDENT
The vault prices shares off `address(this).balance`; the attacker deposits 0.1 ETH, then takes a Balancer flash loan with the *vault* as recipient so 1000 ETH temporarily sits in the vault, inflating the share price, and withdraws their shares at the pumped rate (~750 ETH profit).

THE LESSON
Share prices derived from raw token balance are inflated by donation/flashloan — use internal accounting.

Full analysis: https://t.co/x5CHhlQkKt

#OracleManipulation #DeFi #SmartContract #Security

[s0sta @s0sta_]

BabySwap — access-control (attacker-supplied factory) + reward logic
2022-10 · BSC

THE INCIDENT
The router's `swapExactTokensForTokens` accepts a `factories` array; the attacker deploys a `FakeFactory` whose `getPair` returns itself with fake reserves and no real liquidity, performs two swaps "through" it, then calls `SwapMining.takerWithdraw()` to claim swap-mining rewards for fake volume and sells the BABY rewards.

THE LESSON
Reward/volume accounting must resolve pairs via the canonical factory — never trust caller-supplied factory addresses.

Full analysis: https://t.co/rqrDQoYepW

#AccessControl #SmartContract #DeFi #Security

[s0sta @s0sta_]

BEGO — infinite-mint (empty-signature bypass)
2022-10 · BSC

THE INCIDENT
BEGO's `mint()` verified an ECDSA signature array, but passing empty `r/s/v` arrays skips the verification loop entirely (zero iterations pass), so anyone mints 1e15 BEGO and dumps it for ~12 WBNB.

THE LESSON
Multi-signature verification with arrays must require non-empty arrays — the empty-array edge case bypasses ECDSA.

Full analysis: https://t.co/l6wfcmnKBa

#SignatureValidation #DeFi #SmartContract #Security

[s0sta @s0sta_]

ATK — oracle manipulation (claim price off pool) + flashswap
2022-10 · BSC

THE INCIDENT
The closed-source staking contract's `claimToken1()` prices rewards via the ATK token's `getPrice()` derived from the ATK/BUSDT pair; the attacker flash-swaps the pair's BUSDT, prank-calls the real exploit contract's `claimToken1()` while the price is pumped, then repays the flash swap (~127k BUSDT).

THE LESSON
Claim functions that read live pool reserves are manipulable with a single flash swap — require TWAP or fixed-price oracles.

Full analysis: https://t.co/tuCSiwdRqd

#OracleManipulation #DeFi #SmartContract #Security