What happened
Degen Millionaires Club (DMC) was a BNB Chain project whose DMC token traded on PancakeSwap. On 5 February 2023, at around 3 PM UTC according to the developer, attackers found that mintFromStaking() in the DMC token contract had no access control. Anyone could call it and mint any number of DMC tokens to their own address.
The developer later explained that minting from staking was an abandoned design. The code had been removed from the production contract, but the testnet version that still contained it was deployed to mainnet by mistake, leaving a backdoor mint live from launch day for about two weeks.
Two attackers minted DMC this way and turned it into BNB through the PancakeSwap pool, draining about 60 BNB in total. The developer's account says the attacker minted tokens straight into the LP pool, unbalancing the BNB/DMC ratio, and then pulled the BNB out, and that it created four contracts before one succeeded. According to the existing record, the first attacker received about 56.7 BNB (about $17,256) and the second about 2.25 BNB (about $686). The project planned a relaunch with a new contract, an airdrop to holders from a pre-attack snapshot and rebuilt liquidity, and SolidityScan reports that it relaunched.
DMCtoken:0xa176c5288f6da30dd481a7050f0432b5b3745015- Attackers:
0x8faa29efb03ce3eaacc695bc5d68fcb1f4e13df3,0x91cc4321166c31c6f4b34b3aa97eac9dca444186 - Malicious contract (existing record):
0xf91c9741c5a1f36b5d788e61f0cd27466f7a6dc4 - Attack transactions:
0x80bc0251cd8eb0303c8144d96f3283991736b1afd98bbcb0065c7594ed8b1d47,0x6563608a30f12d590be5b6b0887f23b5ee6cb2c92f9a25e799c9829ea90ba832
How it happened
mintFromStaking(), left over from an abandoned staking-by-minting design, was live in the deployedDMCcontract and did not check who was calling it.- The first attacker deployed attack contracts (four, according to the developer, the last of which worked), minted a large amount of
DMCand dumped it into the PancakeSwap BNB/DMCpool. The developer says the tokens were minted directly to the pool, and the attacker then took out the BNB that the imbalance freed up. - A second attacker used the same function, minted more
DMCand turned part of it into a smaller amount of BNB. - The new supply drained about 60 BNB from the
DMCliquidity. The team then prepared a relaunch with a new contract and an airdrop to pre-snapshot holders.
Protocol details
Evidence
- report Post-mortem medium.com
- transaction bscscan.com transaction 0x80bc…1d47 bscscan.com
- address bscscan.com address 0x8faa…3df3 bscscan.com
- address bscscan.com address 0xf91c…6dc4 bscscan.com
- analysis DMC Hack Analysis — Free Mint Vulnerability (SolidityScan) blog.solidityscan.com
- analysis DMC Exploit 5th February 2023 (Degen Millionaires Club on Medium, Wayback Machine snapshot of 2023-03-21) web.archive.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
