SafeDollar was exploited today and dumped on the open market for ~$250k. It was an infinite mint exploit. The market cap of $SDO was ~$248mm but there was just $250k in exit liquidity,. The attack happened because SafeDollar incentivized a token that has a fee on transfer. 🧵👇 
The attack started with this (seemingly) innocent deposit polygonscan.com/tx/0x55dad44a7…. The attacker planned on increasing the rewards earned by this deposit to a virtually infinite amount (and they did).
The token deposited (polygonscan.com/token/0x7a5dc8…) charges a fee on transfers. Therefore, every time someone withdrew tokens from the rewarder, the rewarder lost some of its balance in fees. Ideally, the fee should have been borne by the user but the rewarder doesn't account for it.
The attacker exploited this bug and drained the token balance of the rewarder by depositing and withdrawing the token in a loop. polygonscan.com/tx/0xd78ff27f3…
The rewarder calculates the reward to give out per token based on its total holdings. i.e. If the rewarder holds a total of 2 token units and the total reward given out is 10, every token unit is eligible to claim 5 rewards.
This is where the accounting mistake(transfer fee) rekts the rewarder. The rewarder checks its total balance and thinks that only 2 token units have been deposited so it sets a very high reward per token value. However, in reality, a lot more tokens are deposited in it.
The innocent-looking initial deposit comes into play now. It had deposited 214,235,502,909,238,707,603 token units (214 * 10^18) earlier. It is now eligible to claim a very high reward for every token unit deposited. All prior deposits are actually eligible to claim high rewards.
The attacker finally claims the $SDO reward and sells the $SDO for ~$202k $USDC and ~$46k $USDT on PolyDex in a single transaction: polygonscan.com/tx/0x1360315a1….
The users providing SDO-USDC and SDO-USDT liquidity and, the ones holding $SDO got rekt.
The users providing SDO-USDC and SDO-USDT liquidity and, the ones holding $SDO got rekt.
The total loss (Fully diluted valuation of $SDO + USDC/USDT pegged in liquidity positions) is over $250mm.
If anything has "Safe" in its' name, it's usually not Safe.
My condolences to those who got rekt in this. It's an ape eats ape world out there, stay safe (pun intended).
If anything has "Safe" in its' name, it's usually not Safe.
My condolences to those who got rekt in this. It's an ape eats ape world out there, stay safe (pun intended).
Correction: FDV of SDO was 450k prior to the hack, not 248m as I previously mentioned. That means, the total loss was 450k (FDV loss) + 250k (USDC + USDT taken by attacker) = 700k.
Thanks to @Rob_Stevens_ for pointing out the mistake.
Thanks to @Rob_Stevens_ for pointing out the mistake.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
