GenomesDAO Hack

Reported loss $43K
Other

What happened

GenomesDAO, a project built around monetising genomic data with DeFi, was attacked on Polygon on 6 August 2022. Its LPSTAKING contract had an initialisation function that anyone could call, and could call again. The attacker used it to swap the contract's staking token for a fake LP token, staked that worthless token, switched the staking token back, and withdrew the real LP tokens that other users had deposited. The existing record puts the loss at about $43,000; SlowMist's analysis gives no figure.

Three victim contracts are listed:

  • 0x3606cFa43f53098BC00b3FCFF3A333F6947F3c92
  • 0x28fc73E9D9f158E7DC57A4E81aa0175d6847f714
  • 0x48D1CcB09f771788F59c8aAAB613936eDfA267b7

Attacker: 0x43ec1d163cc4c15b574f86d8203c3b0f3ebed7a3

Attacker contracts: 0x8e10c9493501a828304d77630b6f862bbf50c052 and fake token 0x9aa63491bb927f024d37b0e6017137f7f03da3c6

Also listed: 0x074f3076ea2c16ef34b15114e751dcdc044ee2e9a26d762a2e96bf97a4509311, an anyMATIC-to-MATIC swap by the attacker.

How it happened

  1. The attacker deployed a fake LP token and called the public initialized function on LPSTAKING, setting the contract's stakingToken to that fake token.
  2. They called stake with the fake LP tokens and received a large amount of LPSTAKING staking certificates.
  3. They called initialized again to set stakingToken back to the real LP token.
  4. They called withdraw, burning the certificates and receiving the real LP tokens held by the contract.
  5. They removed liquidity with those LP tokens on a DEX to take the underlying assets.

Protocol details

Classification NFT
Protocol Type Exploit/Other
Affected asset / contract GENE
Protocol links Website @GenomesDAO

Evidence

Same attack technique

Browse all hacks →
Banana Swap $110K lost Stader.Near $165K lost Whale Loans $12K lost EvoDeFi Bridge $66.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes