What happened
On February 7, 2022, all of EarnHub's EHB staking pools on BNB Smart Chain were drained. EarnHub said an attacker exploited its contracts, took most of the tokens in certain pools and sold them, draining the project's liquidity. Web3 Is Going Great put the loss at about 660 wBNB (around $284K). EarnHub told users to unstake and used its anti-whale mechanism to halt trading.
According to EarnHub's post-mortem, the bug was in makeHop(), a function for moving staked funds between pools cheaply. The feature was not yet in the dApp but had been live in the contract for about a month. When hopping, the contract approved the destination pool to spend the staking token's entire totalSupply, trusting that receiveHop(_pool) would only ever be called on a legitimate pool.
Outside observers questioned whether this was an accident. PeckShield asked whether it was a bug or a backdoor, and CertiK said the incident was likely a rug pull. Neither claim has been proven.
Addresses given in EarnHub's report: exploiter 0x3d98aee279c82d8178b87d9d4dc442d65224dacc, contract A 0x89011932e486Fc3548f82c279Eb502BA7B4aD55F, contract B (the leecher) 0xF7ACFA1cE0e235E7072fA76bD0DC3c3E519BDFe5. PeckShield flagged transaction 0x40e69064c70d7db8b2dcbad441da9a06a507f8f90959da3c2583242f89e01d3c.
How it happened
- The attacker deployed two contracts: A, which staked, and B, the 'leecher'.
- Contract A bought EHB and staked it in an EarnHub pool.
- Contract A called
makeHop()with contract B as the destination pool. The staking contract then approved B to spend the staking token's fulltotalSupply. - Contract B used that allowance to call
transferFrom()repeatedly, pulling every pool's staked tokens out of the staking contract. - The drained tokens were sold, which emptied EarnHub's liquidity pool.
Protocol details
Evidence
- report Report earnhub.medium.com
- report @earnhubBSC incident report twitter.com
- report PeckShield on X: 'Is it a stupid bug or a backdoor?' twitter.com
- report EarnHub Hacked: The EHB Staking Pools Compromised (CoinCodeCap, reproducing EarnHub's post-mortem) coincodecap.com
- transaction bscscan.com transaction 0x40e6…1d3c bscscan.com
- address bscscan.com address 0x3d98…dacc bscscan.com
- address bscscan.com address 0x8901…d55f bscscan.com
- address bscscan.com address 0xf7ac…dfe5 bscscan.com
- address explorer.bitquery.io address outflow explorer.bitquery.io
- analysis EarnHub claims they've been hacked for around $284,000 (Web3 Is Going Great) web3isgoinggreat.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
