DataDAO Finance Hack

A backdoor is created in the supportsInterfaceCall() function that allowed to do calls to token contracts and transfer Part tokens of those who did approvals to the malicious  Part contract.

By 13.09.2022, supportsInterfaceCall() is being continuously called. For now, the last function execution was done on the 10th of Aug 2022. The tokens draining started on the 31th of Jan 2022.

As a result, the following losses take place:

558348 USDC

214749  DAI

8540 MIM

Still, any approved tokens left are endangered and can be drained anytime. This again demonstrates the importance of monitoring approved contracts and checking them for vulnerabilities and backdoors.

Funds lost: 781 637

Backdoor function (supportinterfaceCall())

https://ftmscan.com/address/0x689e0205…a1ae06#code#L1007

Example transactions

https://ftmscan.com/tx/0x754b5ab0…9189d5

https://ftmscan.com/tx/0x5d1242f7…4d088b

Recipient of tokens

https://ftmscan.com/address/0xfc2fb8fd…f8ed69