What happened
On December 19, 2018, the EOS dice game EOS MAX (contract eosmaxiodice) lost 55,526.05 EOS to the attacker account eykkxszdrnnc, according to SlowMist. That day, a wave of rollback attacks hit several EOS gambling dApps, including BetDice and ToBet. EOS MAX suspended the game at 6:40 am on the 19th. Its announcement blamed a loophole in the EOS node rather than in the game contract.
In SlowMist's analysis of the December 19 attacks, bets came from accounts on the block producers' blacklist. Game operators' own nodes accepted and revealed those bets, but block producers later dropped the bets while still including the payouts.
How it happened
- The attacker placed bets through a proxy contract, starting the call from an account that block producers had blacklisted.
- The game's own full node had no blacklist, so it treated the bet as valid while it was still reversible, and the game's off-chain service revealed the result right away.
- The payout went out as a separate transaction from the game's account.
- Block producers dropped the blacklisted bet but included the payout, so the attacker kept winnings without ever paying for the bet.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
