Discover and read the best of Twitter Threads about #CommunityAlert

Most recents (7)

#CommunityAlert 🚨

@ElephantStatus's Treasury contract experienced a #flashloan attack leading to a loss of around $11M. The Treasury contract is unverified and unaudited.

bscscan.com/address/0xd520…
The attacker took advantage of the redeem mechanism of the $TRUNK token, manipulated the price oracle to empower the token return, and stole ELEPHANT from the unverified Treasury contract.

Attack Steps πŸ‘‡
1. The attacker deployed an attacker contract and borrowed $WBNB and $BUSD using flashloan from multiple pair pools.

2. Most of the borrowed WBNB was swapped for ELEPHANT to raise the price of ELEPHANT.
Read 6 tweets
#CommunityAlert 🚨

At 12:13:14 PM UTC, an attacker claimed a large amount of #APECOIN in the airdrop event by flashloan using $BYAC tokens to redeem for #BAYC NFTs.

The total profit of the attack is around ~ $820K (293 #ETH) Image
Incident Analysis

1. The attacker bought NFT No.1060 from OpenSea, which was later used as the flash loan fee to flash loan 5.2 BAYC tokens from the "NFTX Vault"

2. Then used the BAYC tokens borrowed in step 1 to redeem BAYC NFTs (NFT token ID: 7594, 8214, 9915, 8167, 4755) Image
3. Then claimed 60,564 ApeCoin tokens as a reward in the Airdrop contract and sold the majority of $APE on the market to #ETH.

4. Minted BAYC NFTs to BAYC tokens to pay back the flash loan and fees.
Read 3 tweets
#CommunityAlert 🚨

At 11:20:44 PM +UTC, around 379 #BNB (~$150K) was rugpulled by the $Elona deployer.

The deployer removed the liquidity and transferred 540 #BNB in total to Tornado Cash. Image
Steps:

Elona Deployer minted 1 trillion $Elona tokens:
bscscan.com/tx/0x9c6ccc909…

Deployer burned 500 billion tokens and added the other 500 billion as liquidity, along with 196.5 BNB: bscscan.com/tx/0x7d33e841e…
The deployer removed all the liquidity and got around 260,891,540,144.73 Elona and 379.38 BNB: bscscan.com/tx/0xa27da3c3f…

Deployer transferred all the BNB (382.83) to address 0xbff2d5d4e5a4a7b1859ac5edb010fdafe4ea92a8: bscscan.com/tx/0x54d0358e0…
Read 4 tweets
#CommunityAlert 🚨

@FlurryFi’s Vault contracts were attacked leading to around $293K worth of assets being stolen from Vault contracts

Incident Analysis πŸ‘‡
The attacker deployed a malicious token contract, which is also used as the attack contract, and created a PancakeSwap pair for the token and $BUSD.

Attacker: bscscan.com/address/0x0f3c…

Malicious token contract: bscscan.com/address/0xb7a7…

PancakeSwap pair: bscscan.com/address/0xca95…
The attacker flashloaned from Rabbit Bank contract and triggered StrategyLiquidate's execute method.

The execute method decodes input data as the LP token address, the attacker is able to execute code implemented in the malicious token contract. Image
Read 10 tweets
#CommunityAlert🚨

@Meter_IO's Bridge, Meter Passport, has been exploited

Please be cautious if interacting! $MTRG

More info/Analysis coming soon
#IncidentAnalysis

1. The attacker address:
etherscan.io/address/0x8d3d…

$4.3M in funds were moved to Tornado Cash including 1400 ETH (~$4.2M) and 2 WBTC (~$83k)

One of the exploited tx’sπŸ‘‡
bscscan.com/tx/0xc4d7e160c…
The attacker called the `Bridge.deposit()` function to deposit 0.008 BNB to the contract `Bridge` connected to multiple chains including #BSC, #Ethereum, #Moonriver (twice).
Read 5 tweets
#CommunityAlert 🚨

@QubitFin's bridge contract, QBridge, has experience an exploit and minted 77,162 $qXETH worth $80M

QBridge contract on #ETH πŸ‘‡
etherscan.io/address/0x9930…

Use caution if interacting!

Incident Analysis coming soon
@QubitFin Incident Analysis

The hacker called `deposit()` in the QBridge #eth contract w/o really making any deposit and emitted the Deposit event

The exploit was caused by `tokenAddress.safeTransferFrom` in QBridgeHandler.sol which didn't revert the tx when the tokenAddress is the 0x0.
2. The Ethereum QBridge captured the Deposit event and minted $qXETH for the hacker on #BSC.

The QBridge treats the Deposit event as an event of depositing #ETH because the `deposit` and `depositETH` methods in the #QBridge contract emit the same event.
Read 6 tweets
#CommunityAlert 🚨

#Arbix Finance has been identified as #rugpull. Privileged functionalities appear in the identified smart contracts.

The team is looking into it.

DO NOT interact with the project!
Incident AnalysisπŸ‘‡

1. $ARBX contract has mint() with onlyOwner function

2. 10M $ARBX were minted to 8 addresses

3. ~4.5M ARBX were minted to: 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d

4. The 4.5M ARBX were then dumped
The funds deposited by users ($10M) were directed to unverified pools via the depositor contract

The hacker drained all assets from the pools

Depositor address: tinyurl.com/2p983z9d

1 of the unverified pools: tinyurl.com/yp4dj38v

Hacker address: tinyurl.com/4x98ef26
Read 5 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!