What happened
FFgame, a betting game on the EOS blockchain, was drained through a random number attack in the early morning of November 8, 2018. The account jk2uslllkjfd won bet after bet until the game's prize pool was down to about 70 EOS, then moved the EOS to exchanges. SlowMist put the loss at 1,331 EOS. The same account had cracked EOSDice's random number on November 4, and SlowMist later said the attacker behind a second EOSDice hack, and possibly the one behind EOS.WIN, used the same method.
FFgame computed each result on-chain from inputs the attacker could reproduce. According to SlowMist, the attacker deployed a contract that ran the same algorithm as FFgame to work out the random number, and acted on it through an inline action right after the number was generated, so the winning result was effectively known in advance. SlowMist described the underlying weakness as a controllable random seed.
How it happened
- The attacker deployed a contract that reproduced FFgame's random number algorithm using the same on-chain inputs.
- In the same execution, right after the random number was generated, the attack contract used an inline action to act on the result it had already computed, so it only committed to outcomes it knew would win.
- Repeating this gave a near-perfect win rate, draining the prize pool of about 1,331 EOS according to SlowMist. The attacker then sent the EOS to exchanges.
Protocol details
Evidence
- analysis DeFiLlama defillama.com
- analysis SlowMist Hacked - entry 2018-11-08 FFgame (random number attack, 1,331 EOS) hacked.slowmist.io
- analysis 黑客的一周，菠菜游戏接连遭受攻击 (weekly EOS DApp roundup, 2018-11-12, Tencent Cloud developer news repost) cloud.tencent.com
- analysis Defeating EOS Gambling Games: The Tech Behind Random Number Loophole (PeckShield, Nov 22, 2018; Wayback copy) web.archive.org
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
