Incident Overview
On 30th December 2024, FEGtoken (@FEGtoken) was exploited on Ethereum, Binance Smart Chain (BSC), and Base, resulting in total losses exceeding $900,000.
Because the relayer contract did not confirm the legitimacy of the source address for bridge messages, the attacker sent a spoofed payload from Base, convincing the relayer that the withdrawal request was valid. The relayer then approved large sums of FEG tokens for withdrawal on BSC, which the attacker quickly redeemed for profit. The three primary transactions illustrate the progression of the hack: first, the attacker submitted a malicious Wormhole payload from Base; next, the relayer incorrectly authorized token withdrawals on BSC; finally, the attacker withdrew the tokens and monetized them.
This incident underscores the importance of strict source validation in cross-chain relayer contracts.
Incident Report
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to FEG (Feed Every Gorilla), these are the critical security checks that could have prevented this incident (December 2024).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next FEG (Feed Every Gorilla)
The FEG (Feed Every Gorilla) hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.