Leo Finance Hack

A hacker successfully gained access to the token issuing contract and minted a significant amount of $WLEO token which were subsequently dumped in the Uniswap $WLEO/$ETH liquidity pool, netting the attacker $ 42,000 in ill-gotten funds.

LeoFinance is a  Web3 social platform that leverages blockchain database technology to store content and transactions. LeoFinance enables remuneration possibilities for users that create content or interact with the finance content on the platform. For undisclosed reasons the token issuing contract of LeoFinance was exposed. This means that attackers could mint theirselves token, hereby completely changing the supply side of the tokenomics and dump the price of the $WLEO token.

Eventually an attacker used the access to the mint() function, which was successfully invoked at the following example transactions:

https://etherscan.io/tx/0x0e8621db…5c05c8

https://etherscan.io/tx/0x9c0abb76…44f66e

The attack could have yielded more returns for the hacker if the community had not taken notice and withdrawn liquidity from the pool almost instantly as the hack was taking place. The prices of the $WLEO token took an initial hit of 60% but the price recovered later on.

The attacker's address:

https://etherscan.io/address/0x8c9a02c8…9a2495

Minted tokens were sold on Uniswap in a bunch of transactions:

https://bloxy.info/txs/references_address/0x8c9a02c8…9a2495?argument=to&signature_id=1102188