Is it dead or has it just gone to bed?
DODO was hacked for $2 million using a fake token attack, but the motive remains unclear.
One thing’s for sure, whether hat white or black, only $2 million? Must try harder.
Twitter remains the fastest source of news for DeFi - even the DODO team relied on Luciano to tell them that their own $WCRES / $USDT pool had been drained using fake tokens.
The exploits targeted several DODO V2 Crowdpools, namely the WSZO, WCRES, ETHA, and FUSI pool.
In total, approximately $3.8 million, of which $1.88 million is expected to be returned (see below for more information), was drained as a result of these exploits.
The DODO V2 Crowdpooling smart contract has a bug that allows the init() function to be called multiple times. This means that an exploiter can perform an attack with the following steps:
1. Exploiter creates a counterfeit token and initialize the smart contract with it by calling the init() function
2. Exploiter calls the sync() function and sets the “reserve” variable, which represents the token balance, to 0
3. Exploiter calls init() again to re-initialize - this time with a “real” token (i.e. tokens in DODO’s pools)
4. Exploiter uses a flash loan to transfer all real tokens from the pools and bypass the flash loan check
In summary, there are two individuals involved in this exploit. We will refer to them as Individual A and Individual B.
Individual B has all the hallmarks of a frontrunning bot, because:
- They constructed their contract address with a prefix of several 0s
- They use the CHI gastoken
- They set extremely high gas prices; in one instance they raise configured the transaction to use 93,148 gwei.
In addition, Individual B’s exploits preceded Individual A’s successful exploits by roughly ten minutes.
Individual A has already contacted the DODO team through samczsun and offered to send back the funds removed from DODO pools. Here is a detailed account of Individual A’s actions:
Individual A interacted with a centralized exchange.
Individual A withdrew 0.46597 ETH from Binance:
Individual A executed, in quick succession, 7 BUSD withdrawal transactions (see the link for one example), possibly involving the Binance Bridge:
Individual A transfer their funds to another wallet address.
Individual A executed two exploits against DODO smart contracts.
The first one was against the DODO-USDT test contract, and funds were transferred to 0xa305fab8bda7e1638235b054889b3217441dd645.
The second one was against the WCRES-USDT contract, and funds were transferred to 0x56178a0d5f301baf6cf3e1cd53d9863437345bf9.
The funds are now in the following two addresses:
Individual B is most likely a bot. (a robododo)
Suspected bot smart contract: 0x00000000e84f2bbdfb129ed6e495c7f879f3e634
Trigger account address: 0x3554187576ec863af63eea81d25fbf6d3f3f13fc
Individual B executed 3 exploits against DODO contracts:
vETH-WETH, with 93,148 gwei: 0x561f7ccb27b9928df33fa97c2fb99ea3750593e908f9f0f8baf22ec7ca0c5c4a
The funds are currently in the following two addresses:
The DODO team are currently trying to contact the owners of the above addresses.
A relatively small sum of $2 million taken by an anonymous actor.
It’s likely that the colour of the hat changes according to the sums of money that are available.
Small sum = white hat for clout - Big sum = take it and add it to the other millions.
We can only imagine the personal treasuries that these individuals are accumulating. There is so much opportunity out there, and not just for those who choose to learn to code.
It’s noteworthy that even the teams themselves rely on Twitter for updates on their own protocols. This serves as a reminder that we truly are still in the early stages of this industry.
The opportunity to make your name is clear - what you do with the power remains up to you.
REKT serves as a public platform for anonymous authors, we take no responsibility for the views or content hosted on REKT.
Donate (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C
REKT is not responsible or liable in any manner for any Content posted on our Website or in connection with our Services, whether posted or caused by ANON Author of our Website, or by REKT. Although we provide rules for Anon Author conduct and postings, we do not control and are not responsible for what Anon Author post, transmit or share on our Website or Services, and are not responsible for any offensive, inappropriate, obscene, unlawful or otherwise objectionable content you may encounter on our Website or Services. REKT is not responsible for the conduct, whether online or offline, of any user of our Website or Services.
You might also like...
Attacks can happen at any time, but the weekends are always busiest. Social tokens haven’t taken off yet, but that doesn’t mean Roll didn’t get rekt. $5.7 million gone, and still no word from the Roll team.
Willy Wonka returns with the infinite mint, creating 59,471,745.571 PAID tokens before dumping them onto the unsuspecting Oompa Loompas who were providing liquidity to the PAID/ETH pair on Uniswap.
An impressive debut for the first major exploit on BSC, as Meerkat Finance head straight to number three on our leaderboard. Will CZ and team roll back their corporate chain, or allow their users to suffer the loss? This suricate scam leaves the thieves with nowhere to hide.