Thread by @k06a

Our small investigation thread (with @semenov_roman_) on @bZxHQ "duplication incident".

https://twitter.com/bZxHQ/status/1305189177730891776

We compared source code on @etherscan before and after the fix applied:

etherscan.io/address/0xde74…

etherscan.io/address/0xa7eb…

diffchecker.com/qzTJ7Xee

We realized that initial source code works incorrectly when "_from" equals to "_to" and leads to funds duplication. We found 9 exploiting transactions on $iETH lending token with 101778 $iETH tokens duplicated (worth ~4.7K $ETH) // @DuneAnalytics

Attacker address: etherscan.io/address/0xd1c0…

Stolen funds (~4.7K $ETH):
etherscan.io/address/0xe925…