DataDAO Finance Rug Pull

A backdoor is created in the supportsInterfaceCall() function that allowed to do calls to token contracts and transfer Part tokens of those who did approvals to the malicious  Part contract.

By 13.09.2022, supportsInterfaceCall() is being continuously called. For now, the last function execution was done on the 10th of Aug 2022. The tokens draining started on the 31th of Jan 2022.

As a result, the following losses take place:

558348 USDC

214749  DAI

8540 MIM

Still, any approved tokens left are endangered and can be drained anytime. This again demonstrates the importance of monitoring approved contracts and checking them for vulnerabilities and backdoors.

Funds lost: 781 637

Backdoor function (supportinterfaceCall())

Address 0x689e…ae06

Example transactions

Tx 0x754b…89d5

Tx 0x5d12…088b

Recipient of tokens

Address 0xfc2f…ed69