VOW Hack Analysis
Overview:
On 13th August 2023, the VOW project’s USD rate setter function in the v$ contract was exploited, leading to the creation of nearly v$2 billion. This was due to a vulnerability during the testing of the contract’s minting function, which was exploited by a bot that executed a transaction, severely disrupting market conditions.
Smart Contract Hack Overview:
- Attacker : 0x48de6b
- Attack Contract : 0xb7f221
- Vulnerable Contract : 0x1bbf25
- Attack Transaction : 0x758efe
Decoding the Smart Contract Vulnerability:
- The issue occurred during the testing phase of the USD rate setter function within the v$ contract.
- The team adjusted the USD rate, followed by sending 1 million VOW tokens to the contract to verify functionality. This resulted in the minting of v$100 million as expected.
- However, within a 15–30 second window, a bot detected this change and sent 20 million VOW tokens to the contract.
- Due to the absence of adequate safeguards, the contract minted an additional v$2 billion.
- The bot then sold the newly created v$2 billion in the Uniswap pool, disrupting the market and leading to significant price impact.
Mitigation and Best Practices:
· To prevent such rapid exploitation, consider implementing rate limiting and time lock mechanisms within your smart contracts.
Get Shashank’s stories in your inbox
Join Medium for free to get updates from this writer.
· Implement circuit breakers that allow you to pause or halt contract operations in the event of unexpected behavior or attacks.
· Always validate your code by writing comprehensive test cases that cover all the possible business logic.
· To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Our public audit reports can be found on https://github.com/Credshields/audit-reports. Schedule a call at https://credshields.com/
· Scan your Solidity contracts against the latest common security vulnerabilities with 225+ detections at SolidityScan.
Conclusion:
SolidityScan is an advanced smart contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup
Follow us on our Social Media for Web3 security-related updates.
