What happened
HerenciaArtifex NFT project exploited, losing 29,586,973 USD worth of HXA tokens due to a vulnerable code in ThirdWeb development kit.
HerenciaArtifex, an NFT project with native token HXA, was exploited on December 7, 2023. The attacker compromised a signature and gained approval of a large number of tokens from a 0x..dead address, which was used to burn HXA tokens. This allowed the attacker to freely transfer over 450 billion HXA tokens to themselves.
The exploit was related to a vulnerable code in the ThirdWeb development kit, specifically the msgSender parameter in the multiCall function. The stolen funds were transferred through several EOA addresses, distributed, and part of the stolen funds were deposited into various centralized exchanges. The funds lost were calculated based on the current price of the token, and the actual lost amount might be much lower due to liquidity issues in various exchanges.
Attacker Addresses:
Malicious Transaction:
Assets Acquire Transaction:
Malicious Contract Address:
Funding Transaction:
XT.com Deposit Transaction:
Gate.io Deposit Transaction:
HerenciaArtifex's HXA token exploited via ERC2771Context vulnerability, leading to a loss of 29,586,973 USD worth of HXA tokens.
HerenciaArtifex is an NFT project with HXA as its native token. On Dec 07, 2023, the attacker exploited a vulnerability in the ERC2771Context implementation from OpenZeppelin, compromising the Forwarder contract on HXA. This allowed the attacker to gain approval for a massive amount of HXA tokens from the 0x..dead burn address and freely transfer over 450 billion HXA tokens to themselves.
The stolen funds were transferred through several EOA addresses, distributed, and partially deposited into various centralized exchanges. It's worth noting that the actual loss might be lower due to the token's liquidity on exchanges. OpenZeppelin fixed the issue on December 8, 2023.
Attacker Addresses:
Malicious Transaction:
Assets Acquire Transaction:
Malicious Contract Address:
Funding Transaction:
XT.com Deposit Transaction:
Gate.io Deposit Transaction:
Protocol details
Evidence
- report @DeDotFiSecurity incident report twitter.com
- analysis Web Archive archive.ph
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
