Overview:

On July 18, 2023, $BNO suffered an attack on the Binance chain, due to a business logic issue leading to a loss of ~500K USD.

Smart Contract Hack Overview:

• Attackers address: 0xdc1094
• Vulnerable Contract: 0xdca503
• Attack Transaction: 0x33fed5

Fig: Attack Transaction

Decoding the Smart Contract Vulnerability:

• The root cause of the attack was identified as an issue with the reward calculation mechanism within the pool that supported both NFT (Non-Fungible Token) and ERC20 token stakes.
• The pool had an “emergencyWithdraw” function that allowed users to withdraw their ERC20 token stakes instantly. However, crucially, this function did not process or account for NFT stake records.
• The attacker exploited this flaw by depositing both NFT and ERC20 tokens into the pool and then executing the “emergencyWithdraw” function specifically for their ERC20 tokens. By doing so, the attacker could bypass the reward calculation check, effectively manipulating the system to their advantage.
• As a result of this manipulation, the attacker was able to clear the “rewardDebt” of the user, gaining access to undeserved rewards and causing substantial financial damage to the pool and its users.

Fig: The root cause of the vulnerability

Mitigation and Best Practices:

• If a contract supports multiple token standards, ensure that the business logic and math for each token is accounted for, and handled separately.
• Always validate your code by writing comprehensive test cases that cover all the possible business logic.
• To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at Caligo provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://caligosec.com/
• Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detections at Caligo

Caligo — Smart Contract Vulnerability Scanner

Conclusion:

Caligo is an advanced smart-contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts.

Follow us on our Social Media for Web3 security-related updates.
Caligo Security — LinkedIn | Twitter | Telegram