DefiBox Hack

Defibox, an EOS-based DeFi platform whose Swap protocol is an automated market maker, lost about 4,863 EOS (about $24K) from its EOS-EMOON liquidity pool on September 16, 2021. Defibox blamed an incompatibility between its Swap contract and the EMOON token contract. It later said it had removed the risk posed by burning tokens, which indicates EMOON's token-burning behavior was what the Swap contract failed to handle.

Before the incident the pool held about 482.6 trillion EMOON and 4,866.15 EOS. By the time the contract was paused it held about 5.79 trillion EMOON and 3.4553 EOS, so nearly all of the pool's EOS was gone. Defibox has not published the exact sequence of trades or who benefited.

Defibox spotted the abnormal EOS-EMOON swaps at 22:00 HKT on September 16 (14:00 UTC) and suspended the Swap contract at 00:00 HKT on September 17 (16:00 UTC on the 16th). After an audit and multi-signature approval it reopened the contract the same morning. It upgraded the Swap contract to handle burning tokens, and the Defibox Foundation drew on its risk reserve to pay 4,863 EOS to the EMOON community.