What happened
The attacker's address:
The example of transaction behind the attack:
The hack is made possible due to a profit inflation bug, which was exploited to donate a large amount of $NOVAs so that a huge amount of $JAWS tokens can be minted as a reward.
The attacker (based on the example tx):
- Flash loaned 2.5K BNB
- Swapped 569 BNB to 186.5K NOVA
- Deposited 186.5K NOVA to Shiba's NOVA/WBNB LP
- Called getReward() to swap 3.69e-06 NOVA to 561 BNB
- Swapped 280 BNB to 3362 JAWS
- Added liquidity with 280 BNB and 3362 JAWS into JAWS/WBNB LP, receiving 955 LP tokens
- Minted 640,050 JAWS as a reward because of the inflated value of 955 JAWS/WBNB LP tokens
- Called withdrawAll() to withdraw 640,050 JAWS
- Swapped received JAWS to 509 BNB
Stolen funds were bridged into Ethereum. The attacker deposited ETH into Tornado Cash mixer:
Protocol details
Classification
Exchange (DEX)
Protocol Type
Exploit/Other
Affected asset / contract
SHARK
Protocol links
Website
@AutoSharkFin
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
