What happened
On April 12, 2023, MetaPoint on BSC lost more than $920,000 after an unrestricted approval function on user deposit contracts let attackers gain token-transfer authority and sell deposited POT.
How it happened
- Users' deposits created contracts that held POT.
- An attacker repeatedly called the public approval path on those contracts to obtain maximum allowance.
- The attacker transferred the approved deposited tokens and sold them.
- MetaPoint locked the affected contract to prevent further loss.
Protocol details
Classification
Gaming / Metaverse / Access Control
Protocol Type
Exploit/Access control
Affected asset / contract
POT
Implementation language
Solidity
Protocol links
Website
@MetaPoint1024
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
