Incident Overview
The exploiter's address:
https://bscscan.com/address/0x3d98aee2…24dacc
Attacker contract A:
https://bscscan.com/address/0x89011932…4ad55f
Attacker contract B:
https://bscscan.com/address/0xf7acfa1c…9bdfe5
The root of the issue:
The makeHop() function allowed shareholders to shift their funds through different staking pools in a gas-efficient manner. This feature was intended to be implemented on the next dApp update, however, it’s been around for about 1 month on the contract side.
The issue is in the line below, which assumes that there can not be a malicious smart contract on the pool that is called on receiveHop(_pool):
tokenPool.stakingToken.approve(address(_newPool),
tokenPool.stakingToken.totalSupply());
By approving the totalSupply to the new pool, Contract B was able to have allowance to spend the staking contract tokens. This basically means they were able to withdraw them from the staking contract at a whim once that initial setup was made.
The attacker:
- created contract A
- created contract B
- the attacker contract then proceeded to buy some EarnHub, stake it, and make it hop to contract B (makeHop(contractBaddress))
- after receiving the hop, the contract was able to drain the funds from the staking contract by just using the transferFrom() function repeated times.
The example transaction:
https://bscscan.com/tx/0x40e69064…e01d3c
Stolen funds were deposited into Tornado Cash mixer:
https://explorer.bitquery.io/bsc/address/0x3d98aee2…24dacc/outflow
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to EarnHub, these are the critical security checks that could have prevented this incident (February 2022).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next EarnHub
The EarnHub hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.