What happened
The address marked as "hacker" on Etherscan:
1. The contract deployer of the staking contract invoked transferOwnership() at:
2. The newOwner was set to "hacker's" address:
3. The contract deployer of the staking contract upgraded implementation of the contract at:
4. The new implementation is:
5. The new implementation includes rescueTokens() function which allows the owner to withdraw all tokens balance from the contract:
6. The "hacker" invokes rescueTokens() at:
7. The "hacker" burns BRC and receives DAI in exchange:
8. The "hacker" swaps gBRC for DAI on SushiSwap at:
9. Stolen DAI were exchanged on ETH at:
10. Received ETH were deposited into Tornado Cash mixer at multiple transactions:
The hacker was funded by the contract deployer before the incident:
Protocol details
Security review history
- CertiK View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
