Wild Credit was exploited earlier today and the hacker took 125k BNT tokens worth ~$650k. The hacker could have taken all of the 10m TVL locked in the system. The exploit happened due to a very basic issue in the smart contracts that I bet most of the followers can detect. 🧵👇 
Yes, anyone can call the `initialize` function to become the owner of the LP token contract. The owner can freely mint and burn LP tokens. The hacker took ownership of the contract, minted a bunch of tokens to themselves, and then used those fake tokens to withdraw real funds.
Luckily, this hacker was a whitehat and returned the funds to the devs. I am not sure if anyone else exploited it as well. An audit or even a peer review from a decent dev would have prevented this issue.
If the APYs look too good to be true, they probably are.
If the APYs look too good to be true, they probably are.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
