Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesCopyBotsEarn
This Blockchain Game Was Exploited for $4.6 Million Right Before its Launch

This Blockchain Game Was Exploited for $4.6 Million Right Before its Launch

CryptopotatoCryptopotato2024/03/22 19:34
By:Wayne JonesMore posts by this author

The incident led to an approximate loss of $4.6 million due to a vulnerability in its contract that allowed for balance duplication.

Super Sushi Samurai, a blockchain game native to layer-2 solution Blast, was exploited hours before its much-anticipated gaming product was launched.

The exploit, reportedly orchestrated by a white hat hacker, has resulted in a loss of $4.6 million due to a bug in its smart contract code.

Smart Contract Bug Exploited

According to an announcement from the Super Sushi Samurai team, the exploit was due to a bug in the smart contract code, allowing an unauthorized party to initiate an infinite mint function. This resulted in the creation of an excessive number of tokens that were subsequently sold into the liquidity pool.

We have been exploited, it’s mint related. We are still looking into the code. Tokens were minted and sold into the LP.
Transaction: https://t.co/F4XeqdyJu2

the exploited funds are in this wallet: https://t.co/NWeTu5vMkj

— Super Sushi Samurai | SSS (@SSS_HQ) March 21, 2024

CertiK, an on-chain security firm, confirmed the extent of the exploit, stating that $4.6 million worth of tokens were affected. According to CoinGecko data , the exploit led to a 99% token value slippage following an unauthorized token dump. The attacker managed to get 1310 ETH from the token’s main liquidity pool by exploiting the smart contract vulnerability.

Investigations into the incident revealed that an unauthorized party acquired 690 million SSS tokens and initiated a series of transactions through an attack contract designed for this purpose.

The @SSS_HQ $SSS LP was just drained on blast because their token contract has a bug where transferring your entire balance to yourself doubles it.

The order of operations decrements the balance for “from” and then sets the balance for “to” – if these are the same address, the… pic.twitter.com/RStMcFH3sy

— Coffee ☕️🍌 (@coffeexcoin) March 21, 2024

Exploiting a vulnerability within the platform’s update function, the attacker duplicated the tokens in their possession 25 times, inflating the quantity to 11.5 trillion, which was then exchanged for approximately 1,310 ETH.

Recovery Efforts

Following the breach, Super Sushi Samurai has actively engaged with its community, providing updates and assurances through its official Telegram channel and other social media platforms.

In an X post, they revealed that the exploit was conducted by a white hat hacker who is currently in communication with their team. The hacker’s message, visible on Blastscan, indicated that it was a rescue mission and plans to reimburse affected users were underway.

They have also disclosed the address containing the compromised funds to facilitate tracking and potential recovery of the lost assets and that they are working with the white hat hacker to ensure the safe return of funds.

1. Post-mortem:
The token contract has a bug where transferring your entire balance to yourself doubles it. h/t @coffeexcoin

2. Damage details:
total eth in pool before exploit: 1339.50 ETH
Whitehat: 1,310.04 ETH
Blackhat : 40.28 ETH
we remove LP and got: 29.09 ETH

3. Update:…

— Super Sushi Samurai | SSS (@SSS_HQ) March 22, 2024

Meanwhile, a “post-mortem” update from Super Sushi Samurai outlines the extent of the damage, with negotiations ongoing to reach a resolution that safeguards both users and the white hat hacker involved in the incident.

You Might Also Like:

  • Here's Why the Shido Token Crashed 94% Despite the Ongoing Market Rally
  • Baltimore Launches A Blockchain Solution to Vacant Homes Problem
  • Mondelēz International Partners With Hedera on Distributed Ledger Technology
0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Locked for new tokens.
APR up to 10%. Always on, always get airdrop.
Lock now!