ForceDAO Hack

ForceDAO was exploited by one white hat and four black hat hackers.

The white hat hacker's address:

https://etherscan.io/address/0xf88a427c…36b7b2

The black hat #1 hacker's address:

https://etherscan.io/address/0x9d9c3695…b9b00b

The black hat #2 hacker's address:

https://etherscan.io/address/0xe29a0700…2994dd

The black hat #3 hacker's address:

https://etherscan.io/address/0x0608576e…03a0cb

The black hat #4 hacker's address:

https://etherscan.io/address/0x00000b20…41457c

The root cause:

1. The exploited xFORCE vault is a fork of the xSUSHI contract, which assumes that a failed transfer will result in a reversion.
2. The token used in ForceDAO is an Aragon Minime token that returns false if a call to the transferFrom() function fails.

The ForceDAO hackers took advantage of this vulnerability: if a deposit into the xFORCE vault fails, the deposited tokens will remain in the sender’s wallet. However, on the vault’s side, the sender will receive xFORCE tokens in exchange because the code assumes that if it’s still running after the transfer, that the transfer went through successfully.

Black hat #1:

- minted xFORCE:

https://etherscan.io/tx/0xdf05020d…5f0141

- withdrew FORCE, using minted xFORCE:

https://etherscan.io/tx/0x3b60252b…afe118

- sold FORCE:

https://etherscan.io/tx/0x03c84e3f…a987e6

Black hat #2:

- minted xFORCE:

https://etherscan.io/tx/0x7df2fe63…d4b9fd

- withdrew FORCE, using minted xFORCE:

https://etherscan.io/tx/0xe7be5bf2…5ca8d1

- sold FORCE in multiple transactions:

https://etherscan.io/address/0xe29a0700…2994dd

Black hat #3:

- minted xFORCE multiple times:

https://etherscan.io/tx/0x37b44d5d…f6e3d0

https://etherscan.io/tx/0x6202403f…b34f00

https://etherscan.io/tx/0x5a27ee41…4135f8

- withdrew FORCE, using minted xFORCE:

https://etherscan.io/tx/0x2616ae9f…c732a8

- sold FORCE in multiple transactions:

https://etherscan.io/address/0x0608576e…03a0cb

Black hat #4:

- withdrew FORCE, using minted xFORCE:

https://etherscan.io/tx/0x8aedc3d1…020317

https://etherscan.io/tx/0xef10be2c…75ebb6

- minted xFORCE multiple times:

https://etherscan.io/tx/0xef10be2c…75ebb6

https://etherscan.io/tx/0xf8352e96…911e39

https://etherscan.io/tx/0xc4abacc3…898106

- sold FORCE in multiple transactions:

https://etherscan.io/address/0x00000b20…41457c

- later, funds were returned:

https://etherscan.io/tx/0x4d535b8c…60b793