Gym Network Hack

Reported loss $2.1M
BNB Chain
Deposit Function Exploit

What happened

On June 8, 2022, an attacker drained Gym Network's GymSinglePool staking contract on BNB Chain. A new depositFromOtherContract() function, deployed two days earlier, let anyone record a deposit without sending tokens. The attacker booked an 8,000,000 GYMNET deposit for free, withdrew it, and swapped the tokens to BNB. Rekt and ChainZoom put the loss at about $2.1M; CertiK's analysis gives a lower figure of about 2,475.91 WBNB (~$716K at the time).

Rekt traced the proceeds: about 2k BNB went to Tornado Cash, about 3k BNB stayed on the attacker's BSC address, and about 2.5k BNB was converted to 387 ETH and bridged to Ethereum. Gym Network fixed the function by adding an onlyBank modifier so only the bank contract can call it. CertiK said its earlier audit did not cover the new code; Rekt reports that both CertiK and PeckShield audited the project in May 2022, before the faulty function was added.

  • Attacker (BSC): 0xb2c035eee03b821cbe78644e5da8b8eaa711d2e5
  • Attacker contract: 0x7cbfd7bccd0a4a377ec6f6e44857efe42c91b6ea
  • Vulnerable implementation: 0x0288fba0bf19072d30490a0f3c81cd9b0634258a
  • Repaired contract: 0x7df0bc661b6a239ae2f41f9548f6b17f7bd8328b
  • Example transactions: 0x171a448161f2c438cca0502599a6784561d11099c9218e2125c5f3c7a6705dd3, 0x91f5e625447da3e7d0d409d5c7762c94c4d5793ab34430b81a9889e5ef9f37dd, 0x12970f3962b4bacd01bb4e3dc086804e4e5861134db5dd80d7e4671aa7f23d16

How it happened

  1. The attacker deployed contracts and called depositFromOtherContract(), a public wrapper around _autoDeposit(), with a deposit amount of 8,000,000 GYMNET.
  2. Unlike deposit(), which pulls tokens with safeTransferFrom, _autoDeposit() only called approve and never moved the caller's tokens, yet it still wrote a deposit record.
  3. The attacker called withdraw() and received 8,000,000 real GYMNET from the pool against the fake record.
  4. The attacker swapped the GYMNET to BNB and sent the proceeds to 0xb2c035eee03b821cbe78644e5da8b8eaa711d2e5, later moving part through Tornado Cash and part to Ethereum.

Protocol details

Classification Gaming / Metaverse / Access Control
Protocol Type Exploit/Other
Affected asset / contract GYMNET
Implementation language Solidity
Protocol links Website @GymNet_Official

Security review history

  • CertiK 2022-05-06 No public report

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes