Incident Overview
HerenciaArtifex NFT project exploited, losing 29,586,973 USD worth of HXA tokens due to a vulnerable code in ThirdWeb development kit.
HerenciaArtifex, an NFT project with native token HXA, was exploited on December 7, 2023. The attacker compromised a signature and gained approval of a large number of tokens from a 0x..dead address, which was used to burn HXA tokens. This allowed the attacker to freely transfer over 450 billion HXA tokens to themselves.
The exploit was related to a vulnerable code in the ThirdWeb development kit, specifically the msgSender parameter in the multiCall function. The stolen funds were transferred through several EOA addresses, distributed, and part of the stolen funds were deposited into various centralized exchanges. The funds lost were calculated based on the current price of the token, and the actual lost amount might be much lower due to liquidity issues in various exchanges.
Attacker Addresses:
https://etherscan.io/address/0x00000000…CE2436
https://etherscan.io/address/0x396E753a…052619
Malicious Transaction:
https://etherscan.io/tx/0x71f0c8f7…e4208c
Assets Acquire Transaction:
https://etherscan.io/tx/0x4f534c08…7c5c1f
Malicious Contract Address:
https://etherscan.io/address/0x00000000…eFd4F8
Funding Transaction:
https://etherscan.io/tx/0x71f0c8f7…e4208c
XT.com Deposit Transaction:
https://etherscan.io/tx/0xe67a20f1…1427f6
Gate.io Deposit Transaction:
https://etherscan.io/tx/0xad453b12db924c9a091bfec15f0f601241f470383c4fd03bc4424c9866690309Quick Summary
HerenciaArtifex's HXA token exploited via ERC2771Context vulnerability, leading to a loss of 29,586,973 USD worth of HXA tokens.
HerenciaArtifex is an NFT project with HXA as its native token. On Dec 07, 2023, the attacker exploited a vulnerability in the ERC2771Context implementation from OpenZeppelin, compromising the Forwarder contract on HXA. This allowed the attacker to gain approval for a massive amount of HXA tokens from the 0x..dead burn address and freely transfer over 450 billion HXA tokens to themselves.
The stolen funds were transferred through several EOA addresses, distributed, and partially deposited into various centralized exchanges. It's worth noting that the actual loss might be lower due to the token's liquidity on exchanges. OpenZeppelin fixed the issue on December 8, 2023.
Attacker Addresses:
https://etherscan.io/address/0x00000000…CE2436
https://etherscan.io/address/0x396E753a…052619
Malicious Transaction:
https://etherscan.io/tx/0x71f0c8f7…e4208c
Assets Acquire Transaction:
https://etherscan.io/tx/0x4f534c08…7c5c1f
Malicious Contract Address:
https://etherscan.io/address/0x00000000…eFd4F8
Funding Transaction:
https://etherscan.io/tx/0x71f0c8f7…e4208c
XT.com Deposit Transaction:
https://etherscan.io/tx/0xe67a20f1…1427f6
Gate.io Deposit Transaction:
https://etherscan.io/tx/0xad453b12…690309
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Herencia Artifex, these are the critical security checks that could have prevented this incident (December 2023).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
-
02
Web Archive https://archive.ph/UpdYg
Learn to Prevent the Next Herencia Artifex
The Herencia Artifex hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.