#CommunityAlert π¨
@QubitFin's bridge contract, QBridge, has experience an exploit and minted 77,162 $qXETH worth $80M
QBridge contract on #ETH π
etherscan.io/address/0x9930β¦
Use caution if interacting!
Incident Analysis coming soon
@QubitFin's bridge contract, QBridge, has experience an exploit and minted 77,162 $qXETH worth $80M
QBridge contract on #ETH π
etherscan.io/address/0x9930β¦
Use caution if interacting!
Incident Analysis coming soon
@QubitFin Incident Analysis
The hacker called `deposit()` in the QBridge #eth contract w/o really making any deposit and emitted the Deposit event
The exploit was caused by `tokenAddress.safeTransferFrom` in QBridgeHandler.sol which didn't revert the tx when the tokenAddress is the 0x0.
The hacker called `deposit()` in the QBridge #eth contract w/o really making any deposit and emitted the Deposit event
The exploit was caused by `tokenAddress.safeTransferFrom` in QBridgeHandler.sol which didn't revert the tx when the tokenAddress is the 0x0.
2. The Ethereum QBridge captured the Deposit event and minted $qXETH for the hacker on #BSC.
The QBridge treats the Deposit event as an event of depositing #ETH because the `deposit` and `depositETH` methods in the #QBridge contract emit the same event.
The QBridge treats the Deposit event as an event of depositing #ETH because the `deposit` and `depositETH` methods in the #QBridge contract emit the same event.
3. The hacker repeated steps 1 & 2 to gain a large amount of $qXETH. Lastly, the hacker converted all the assets to $BNB and the profit is around $80M.
QBridge (Eth):
0x99309d2e7265528dc7c3067004cc4a90d37b7cc3
One of the tx:
etherscan.io/tx/0xac7292e7dβ¦
QBridge (Eth):
0x99309d2e7265528dc7c3067004cc4a90d37b7cc3
One of the tx:
etherscan.io/tx/0xac7292e7dβ¦
Full analysis π
https://twitter.com/CertiKTech/status/1487135904481398794?s=20&t=6wwcMlJRS1p2nVETZEfetg
β’ β’ β’
Missing some Tweet in this thread? You can try to
force a refresh
γ
