Incident Overview
The Degen Millionaires Club lost about 60 $BNB due to a flaw in their smart contract.
Degen Millionaires Club is a token sniper project on the Binance chain. The project's token DMC is trading on PancakeSwap. On February 5, 2023, the Degen Millionaires Club project was hacked, which allowed free minting for any external caller.
During the investigation of the attack, it was discovered that the access restriction to mintFromStaking() had been seriously breached, allowing any caller to mine any number of tokens to their address.
Taking advantage of the lack of access control, the first attacker created 8,232,474 $DMC tokens and managed to sell 56.7 $BNB which equals 17,256 $USD. The attacker used malicious contract deployment with unverified source code to perform the actions below. The second attacker also created 32,409,804 $DMC tokens and sold far fewer tokens worth 686 $USD equivalent to 2.25 $BNB. They exchanged them for $BNB equivalents via PancakeSwap. The total amount stolen cost the owners of the Degen Millionaires Club about 60 $BNB. The project was informed of the compromise and restarted the project.
Attacker’s address:
https://bscscan.com/address/0x8faa29ef…e13df3
Malicious contract:
https://bscscan.com/address/0xf91c9741…7a6dc4
Malicious transaction:
https://bscscan.com/tx/0x80bc0251…8b1d47
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Degen Millionares Club, these are the critical security checks that could have prevented this incident (February 2023).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Degen Millionares Club
The Degen Millionares Club hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.