4 ms·
It was an intentional backdoor in the contract. https://bscscan.com/address/0x7e0c621ea9f7afd5b86a50b0942eaee68b04a61c#code https://bscscan.com/address/0x7e0c6
by qqii 6y ago
It was an intentional backdoor in the contract.
https://bscscan.com/address/0x7e0c621ea9f7afd5b86a50b0942eaee68b04a61c#code https://bscscan.com/address/0x7e0c621ea9f7afd5b86a50b0942eae...
Note line 304 the O is a 0:
bytes32 slot = ADMIN_SL0T;
- KirillPanov 6y agoHoly crap you're right. This is like in Java, where you mean to override a method in a superclass but mis-spell the name of the method and therefore instead end up simply adding a new method with the mis-spelled name. I guess either Solidity doesn't have something like Java 1.5+'s @Override, or else it just wasn't used. In any case it's hard to believe this was accidental. Of all the places you could make this mistake, most of the others wouldn't result in a massive exploit like this.
- hulahoof 6y agoI don't think anyone would consider an accident possible after they stole the funds.
- KirillPanov 6y agoWell there have been other accidental bugs (reentrancy, for one) that got exploited by thieves who turned out not to be the devs. But I agree, that's not what happened here.
- ashkankiani 6y agoThis is definitely the funniest thing I've read this week.
- gruez 6y agoCan you elaborate on this? How does swapping out O for a 0 introduce a backdoor?
- qqii 6y agoYou can find the details in this article (not written by me): https://obelisk.medium.com/meerkat-finance-and-the-0-that-was-worth-31m-769d9321d245 https://obelisk.medium.com/meerkat-finance-and-the-0-that-wa... In short: * the smart contact is made in a way that allows upgrades by an administrator * the developers transfer their administrator privileges to another user as a show of good faith * the code to transfer the privileges actually doesn't do anything * the developers upgrade the contract giving themselves permission to take the funds
- londons_explore 6y agoLooks to me like the 0 breaks the functionality for setting a new admin. It dosn't directly break any permissions stuff, and in fact I don't think it leads to a backdoor itself. Then elsewhere on line 50, anybody who creates a Proxy object will automatically be made the admin with zero auth.
- deleted 6y ago[deleted]