What happened
On February 14, 2024, the MINER project's experimental ERC-X token implementation was exploited on Ethereum. Verichains estimated the loss at about 460,000 dollars and traced it to a self-transfer balance-update flaw that let the attacker inflate MINER holdings before draining WETH from the WETH/MINER Uniswap V3 pool.
How it happened
- The attacker invoked the ERC-X token contract's transfer path with the same address as sender and recipient.
- The flawed update logic used a cached recipient balance, increasing the attacker's MINER balance by the transferred amount.
- During a Uniswap V3 swap callback, the attacker repeated self-transfers to inflate MINER holdings.
- The attacker supplied the inflated MINER to the WETH/MINER pool and drained its WETH liquidity.
Protocol details
Classification
Token / Input Validation
Protocol Type
Gamified Mining
Affected asset / contract
MINER
Implementation language
Solidity
Protocol links
Website
@minerercx
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
