Incident Overview
The transaction behind the attack:
https://bscscan.com/tx/0xfbe65ad3…a66f13
The attacker's address:
https://bscscan.com/address/0xd9c7efe2…298a3b
The attacker:
- added a small sum of deposit to the SHARK-BNB Vault:
https://bscscan.com/tx/0x2a2003fb…b8e125
- borrowed 100K BNB of flash loan from PancakeSwap
- swapped 50K BNB into SHARK token and sent them alongside the rest 50K BNB to the SharkMinter contract
- called getReward() with the deposit of SHARK-BNB Vault from the first step
- with the huge amount of SHARK token and WBNB in the wallet balance of the minter contract, it returned an extremely large amount of profit. As a result, the system minted 100M SHARK as a reward to the hacker
- sold SHARK token for 102K WBNB, repaid flash loans, taken out 2.2K WBNB
- exchanged BNB on ETH at:
https://bscscan.com/tx/0xa6e265b9…011df7
- bridged ETH into Ethereum network:
https://bscscan.com/tx/0x33c01cf4…b0ba3b
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to AutoShark, these are the critical security checks that could have prevented this incident (May 2021).
- Verify all logic paths related to Flashloan Incentive Rewards Exploit / Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next AutoShark
The AutoShark hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.