Incident Overview
Hedera Token Service was exploited via smart contract decompiling issue, leading to the theft of liquidity pool tokens from multiple DEXs.
Hedera Token Service is a public network which is powered by the Hedera Hashgraph blockchain.
On March 9, 2023, the attacker exploited the Hedera Token Service of the Hedera mainnet. The attacker targeted token in multiple liquidity pools at various DEXs that use Uniswap-derived contract code ported over to use the Hedera Token Service, including Pangolin, SaucerSwap, and HeliSwap. The amount of tokens stolen has not been confirmed. To prevent the attacker from stealing more tokens, Hedera turned off mainnet proxies, which removed user access to the mainnet. The Hedera Team announced in their official Twitter, the root cause of the issue was identified and solution is in progress. Once the solution is ready, Hedera Council members will sign transactions to approve the deployment of the code on mainnet to remove this vulnerability, at which point the mainnet proxies will be turned back on, allowing normal activity to resume, they claimed.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Hedera Token Service, these are the critical security checks that could have prevented this incident (March 2023).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialPost-Incident Timeline
-
2023-03-11
The stolen amount was calculated by the Hedera Team and reached roughly 600,000 $USD worth 3,630,000 $WHBAR, 287,998 $USDC, 66,997 $USDT, and 1,001 $DAI according to the project's official blog
Sources & References
Learn to Prevent the Next Hedera Token Service
The Hedera Token Service hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.