Blizzard Hack

The insider attack was performed by 2 team members: front-end and back-end developers.

Developers had access to the key contracts as they were members of a multisignature account, which requires only 2 signs.

1. Whitehat reported found bug in the vault contracts to the Immunefi team
2. Whitehat received bug bounty and the core team of Blizzard asked the back-end developer to remove retired vaults, put 0 reward rate and disable deposits.
3. Front-end and back-end started testing new vaults:

Tx 0xf66a…f48e

4. Back-end dev set the rewardMintRate to 50 BLIZZ per block
5. Developers exploited the harvesting issue:

Tx 0xa781…0363

6. Front-end dev had removed the retired PNG-AVAX vaults from the website front.
7. Developers exploited a single USDC vault:

Address 0xdb69…b64e

8. Developers dumped received tokens:

Tx 0x7cd6…e482

9. Attackers used Anyswap bridge to transfer funds on Ethereum, and then, on the Binance Smart Chain

Tx 0x198c…1495

10. Stolen funds were deposited into Tornado Cash mixer at:

Source

The exploit is described in 3 steps:

• Modify the rewardRate, by calling setRewardMintRate(uint256 _rate) with the following parameter: 50000000000000000000
• Deposit any amount of USDC and wait until the desired amount of tokens has been minted
• Call claim() to transfer the rewards from the origin pool and additional minted token rewards from the aggregator to the beneficiary.