Degen Millionares Club Hack

The Degen Millionaires Club lost about 60 $BNB due to a flaw in their smart contract.

Degen Millionaires Club is a token sniper project on the Binance chain. The project's token DMC is trading on PancakeSwap. On February 5, 2023, the Degen Millionaires Club project was hacked, which allowed free minting for any external caller.

During the investigation of the attack, it was discovered that the access restriction to mintFromStaking() had been seriously breached, allowing any caller to mine any number of tokens to their address.

Taking advantage of the lack of access control, the first attacker created 8,232,474 $DMC tokens and managed to sell 56.7 $BNB which equals 17,256 $USD. The attacker used malicious contract deployment with unverified source code to perform the actions below. The second attacker also created 32,409,804 $DMC tokens and sold far fewer tokens worth 686 $USD equivalent to 2.25 $BNB. They exchanged them for $BNB equivalents via PancakeSwap. The total amount stolen cost the owners of the Degen Millionaires Club about 60 $BNB. The project was informed of the compromise and restarted the project.

Attacker’s address:

https://bscscan.com/address/0x8faa29ef…e13df3

Malicious contract:

https://bscscan.com/address/0xf91c9741…7a6dc4

Malicious transaction:

https://bscscan.com/tx/0x80bc0251…8b1d47