GeoDB Hack

Reported loss Not disclosed
Other

What happened

On October 19, 2022, an attacker minted 10,000,000,000,000,000 BGEO, GeoDB's token on BNB Smart Chain, without authorization. That was 99.99% of the supply.

BGEO's mint function was a bridge mint meant to run only with signatures from GeoDB's authorized signers. The check could be skipped by passing empty signature arrays. PeckShield summed it up as a mint() that allowed unlimited mints.

The large mint went to the attacker's address and stayed there. DeFiHackLabs records a second transaction from the same attacker that minted more BGEO and sold it into the PancakeSwap BGEO/WBNB pool for about 12 WBNB. The realized profit was small because the pool was shallow.

Attacker: 0xde01f6ce91e4f4bdb94bb934d30647d72182320f Mint transaction: 0x2673936a1191a35c24b60dd697644c953da321b4395b836439faa319b8335886 Swap transaction (per DeFiHackLabs): 0x9f4ef3cc55b016ea6b867807a09f80d1b2e36f6cd6fccfaf0182f46060332c57

How it happened

  1. BGEO's mint(_amount, _txHash, receiver, _r, _s, _v) is guarded by an isSigned modifier. It hashes the chain tag, msg.sender, _txHash and _amount, recovers one signer per (v, r, s) entry with ecrecover, and requires isSigners(_signers).
  2. checkSignParams only checks that the three arrays have equal length, so three empty arrays pass. The recovery loop then runs zero times, _signers is empty, and isSigners accepts the empty list. No minimum number of signatures was enforced.
  3. The only other check is that the _txHash string has not been used before, so any new string works.
  4. The attacker called mint with empty arrays and minted 10,000,000,000,000,000 BGEO to 0xde01...320f (tx 0x2673936a...5886).
  5. In a separate transaction, 0x9f4ef3cc...2c57, the attacker minted more BGEO the same way and swapped it for about 12 WBNB in the PancakeSwap BGEO/WBNB pair.

Protocol details

Classification Other
Protocol Type Exploit/Other
Affected asset / contract BGEO
Protocol links Website @data_verse

Evidence

Same attack technique

Browse all hacks →
Deri Protocol $145K lost Victor the Fortune $58K lost Journey of Awakening $127K lost Rabby Wallet $194K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes