MEV isn't for the faint of heart
Here's a searcher whose contract had a bug and got exploited, losing them $1m in a single transaction (!)
etherscan.io/tx/0xcc25b53fd…
Here's a searcher whose contract had a bug and got exploited, losing them $1m in a single transaction (!)
etherscan.io/tx/0xcc25b53fd…
The above searcher wrote their contract in Yul and had a function for token approvals that they didn't have the appropriate checks on.
The attacker reverse engineered the decompiled assembly, found the never used approve function, and figured out the custom data input format.
The attacker reverse engineered the decompiled assembly, found the never used approve function, and figured out the custom data input format.
I'm starting to think there might be one or two sharks out there that are doing this full time.
What a job that would be: decompiled assembly bug finder
... starting salary $5m/year
What a job that would be: decompiled assembly bug finder
... starting salary $5m/year
Anyway, there's nothing really to dig into here. Just a straightforward bug in a contract (not requiring the caller of a function was the owner) and an attacker who threaded a needle somehow to find that.
I should make a hall of fame for this or something
• • •
Missing some Tweet in this thread? You can try to
force a refresh
