Incident Overview
On May 24th, Hackerdao token contract was attacked for 200BNB. The WBNB-Hackerdao pair has been drained in this transaction 0x04673c950....
Attacker transaction: https://bscscan.com/tx/0x04673c95…08422d
Blocksec transaction: https://versatile.blocksecteam.com/tx/bsc/0x04673c95…08422d
Attacker address: https://bscscan.com/address/0xcFc591dB…Cd1f82
Attacker contract: https://bscscan.com/address/0x24cb6980…9a4694
Victim contract: https://bscscan.com/address/0x94e06c77…13eC1C
Attack step by step:
1) The attacker used the logic of the Hackerdao contract vulnerability, in which the _transfer function incorrectly processes the uniswapV2 pair.
2) Then, if the recipient's address is the specified Uniswap pair (BSCUSD-Hackerdao pair, 0xbdb426a2…ae0225), the additional commission amount will be further reduced from the sender. This leads to a typical pattern of token attacks: if the balance of a Uniswap pair can be reduced without any swap (i.e. the difference between the recorded reserves and the actual token balances), there is a possibility of price manipulation.
3) The attack is carried out by switching from a pair of WBNB-Hackerdao to a pair of BSCUSD-Hackerdao, which leads to an unbalanced price.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Hackerdao, these are the critical security checks that could have prevented this incident (May 2022).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
Learn to Prevent the Next Hackerdao
The Hackerdao hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.