Thread by @HalbornSecurity

1/ In November 2022, Skyward Finance became the first project in the NEAR ecosystem on the Rekt leaderboard of the biggest #DeFi hacks. The attacker exploited vulnerabilities in the Skyward contracts to drain approximately $3.2 million in tokens from the project. #cryptocurrency

2/ The Skyward hack was made possible by a vulnerability in the redeem_skyward function within the project’s #SmartContracts. This function allows users to redeem the SKYWARD tokens they have earned for wNEAR tokens stored within the contract.

#Hacked #Blockchain #Security

3/ The redeem_skyward function failed to properly validate token_account_ids when processing redemptions. The function verified that a provided token_account_id was valid but not that it was unique. The attacker exploited this vulnerability.

#CyberSecurity #Blockchain #Hacked

4/ One of the reasons this hack was possible was because the contract unnecessarily allowed multiple token_account_ids to be passed to the redeem_skyward function when only one was necessary.

5/ This type of simple vulnerability could have been detected and remediated by a smart contract audit before the contract was deployed to the #blockchain

#SmartContracts #CryptoNews

6/ This type of simple vulnerability could have been detected and remediated by a smart contract audit before the contract was deployed to the blockchain. Learn how to secure your project’s smart contracts: halborn.com/explained-the-…
#SmartContracts #BlockchainNews #DeFi