Tweet

CertiK Security Leaderboard

Feb 5 • 5 tweets • 3 min read

@Meter_IO

#CommunityAlert🚨

@Meter_IO's Bridge, Meter Passport, has been exploited

Please be cautious if interacting! $MTRG

More info/Analysis coming soon

#IncidentAnalysis

1. The attacker address:
etherscan.io/address/0x8d3d…

$4.3M in funds were moved to Tornado Cash including 1400 ETH (~$4.2M) and 2 WBTC (~$83k)

One of the exploited tx’s👇
bscscan.com/tx/0xc4d7e160c…

The attacker called the `Bridge.deposit()` function to deposit 0.008 BNB to the contract `Bridge` connected to multiple chains including #BSC, #Ethereum, #Moonriver (twice).

The attacker injected the following malicious data by calling `Bridge.deposit() 👇

Then the `Bridge.deposit()` invoked `ERC20Handler.deposit()` function with the following input 👇

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @CertiKCommunity

CertiK Security Leaderboard

@CertiKCommunity

Jan 28

@QubitFin

#CommunityAlert 🚨

@QubitFin's bridge contract, QBridge, has experience an exploit and minted 77,162 $qXETH worth $80M

QBridge contract on #ETH 👇
etherscan.io/address/0x9930…

Use caution if interacting!

Incident Analysis coming soon

@QubitFin

@QubitFin Incident Analysis

The hacker called `deposit()` in the QBridge #eth contract w/o really making any deposit and emitted the Deposit event

The exploit was caused by `tokenAddress.safeTransferFrom` in QBridgeHandler.sol which didn't revert the tx when the tokenAddress is the 0x0.

2. The Ethereum QBridge captured the Deposit event and minted $qXETH for the hacker on #BSC.

The QBridge treats the Deposit event as an event of depositing #ETH because the `deposit` and `depositETH` methods in the #QBridge contract emit the same event.

Read 6 tweets

CertiK Security Leaderboard

@CertiKCommunity

Jan 4

#CommunityAlert 🚨

#Arbix Finance has been identified as #rugpull. Privileged functionalities appear in the identified smart contracts.

The team is looking into it.

DO NOT interact with the project!

Incident Analysis👇

1. $ARBX contract has mint() with onlyOwner function

2. 10M $ARBX were minted to 8 addresses

3. ~4.5M ARBX were minted to: 0x161262d172699cf0a5e09b6cdfa5fee7f32c183d

4. The 4.5M ARBX were then dumped

The funds deposited by users ($10M) were directed to unverified pools via the depositor contract

The hacker drained all assets from the pools

Depositor address: tinyurl.com/2p983z9d

1 of the unverified pools: tinyurl.com/yp4dj38v

Hacker address: tinyurl.com/4x98ef26

Read 5 tweets

Share this page!

CertiK Security Leaderboard

Try unrolling a thread yourself!

More from @CertiKCommunity

CertiK Security Leaderboard

CertiK Security Leaderboard

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Like this author's thread?