Gym Network Hack

Gym Network has been exploited for $2.1M. The depositFromOtherContract() function is a wrapper for the _autoDeposit() function, where there is no transfer() function to transfer a user’s deposit to the contract, so a user can call deposit() and ‘create deposit record’ without actually transferring tokens.

Now function is resolved adding onlyBank() modifier.

Exploiter address (BSC): https://bscscan.com/address/0xb2c035ee…11d2e5

Exploiter contract (BSC): https://bscscan.com/address/0x7cbfd7bc…91b6ea

Victim contract: https://bscscan.com/address/0x0288fba0…34258a

Repaired contract: https://bscscan.com/address/0x7df0bc66…d8328b

Exploiter transactions example:

1. Tx
2. Tx
3. Tx

The attacker has created several contracts to perform these steps:

The attacker calls the depositFromOtherContract()  function with the deposit amount set to 8M GYMNET, without transferring money because there is no transfer function.

Next attacker calls withdraw() function to withdraw 8M GYMNET.

Then attacker swaps GYMNET tokens to BNB and sends them to this address: https://bscscan.com/address/0xb2c035ee…11d2e5

All funds were laundered via TornadoCache.