Incident Overview
Gym Network has been exploited for $2.1M. The depositFromOtherContract() function is a wrapper for the _autoDeposit() function, where there is no transfer() function to transfer a user’s deposit to the contract, so a user can call deposit() and ‘create deposit record’ without actually transferring tokens.
Now function is resolved adding onlyBank() modifier.
Exploiter address (BSC): https://bscscan.com/address/0xb2c035ee…11d2e5
Exploiter contract (BSC): https://bscscan.com/address/0x7cbfd7bc…91b6ea
Victim contract: https://bscscan.com/address/0x0288fba0…34258a
Repaired contract: https://bscscan.com/address/0x7df0bc66…d8328b
Exploiter transactions example:
1) https://bscscan.com/tx/0x171a4481…705dd3
2) https://bscscan.com/tx/0x91f5e625…9f37dd
3) https://bscscan.com/tx/0x12970f39…f23d16
The attacker has created several contracts to perform these steps:
The attacker calls the depositFromOtherContract() function with the deposit amount set to 8M GYMNET, without transferring money because there is no transfer function.
Next attacker calls withdraw() function to withdraw 8M GYMNET.
Then attacker swaps GYMNET tokens to BNB and sends them to this address: https://bscscan.com/address/0xb2c035ee…11d2e5
All funds were laundered via TornadoCache.
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Gym Network, these are the critical security checks that could have prevented this incident (June 2022).
- Verify all logic paths related to Deposit Function Exploit / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Certik Report
Sources & References
-
01
Source 1 https://rekt.news/gymnet-rekt/
- 02
Learn to Prevent the Next Gym Network
The Gym Network hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.