Incident Overview
Local Traders, a P2P exchange on Binance Smart Chain was exploited due to a lack of permission checks in their smart contract. The attacker modified the owner and token price resulting in a loss of 115,595 $USD.
On May 23, 2023, the Local Traders platform was exploited on the Binance Smart Chain resulting in a loss of approximately 379.32 BNB worth around $115,595 at that time. The vulnerability was caused by a lack of permission checks in one of their functions which allowed anyone to modify the owner using this function implementation. The attacker then called another function to modify the price of LCT tokens to purchase them at low prices and sold them for profit.
All stolen funds are currently held by the attacker's address which has been reported and blacklisted by exchanges making it difficult for the hacker to cash out. The Local Traders team is working on implementing a recovery plan for affected users.
Attacker address:
https://bscscan.com/address/0xd771dfa8…276dd7
Malicious transaction:
https://bscscan.com/tx/0x49a30386…300dfb
Access gain transaction:
https://bscscan.com/tx/0x57b589f6…2be5ba
Price change transaction:
https://bscscan.com/tx/bea605b238c85aabe5edc636219155d8c4879d6b05c48091cf1f7286bd4702ba
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Local Traders, these are the critical security checks that could have prevented this incident (May 2023).
- Verify all logic paths related to Access Control Exploit / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Proof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://twitter.com/numencyber/status/1661213691893944320
Sources & References
Learn to Prevent the Next Local Traders
The Local Traders hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.