n00dleswap Hack

What happened

On October 25, 2022, n00dleSwap, an NFT and token exchange on Ethereum, lost about 20.8 WETH (around $31,000) to a reentrancy attack. Its n00d token is ERC777, which calls hooks on the sender and receiver during transfers. The attacker registered their contract as a hook handler and re-entered the xn00d staking bar's enter() from inside the token's tokensToSend callback. That minted more xn00d than the attacker had deposited, and the extra n00d was sold on SushiSwap for WETH.

The proceeds went to the attacker's original address.

Attacker: Address 0x8ca7…0ff0

Attack contract: Address 0x9c5a…9c56

Exploit transaction: Tx 0x8037…3aea

How it happened

1. The attack contract registered itself in the ERC1820 registry as the ERC777 sender/recipient hook for n00d, so n00d transfers would call back into it.
2. It flash-swapped n00d from the SushiSwap n00d/WETH pair (0x5476...a389).
3. Inside the callback, it called the xn00d bar's enter(). When the bar pulled n00d from the attacker, the tokensToSend hook fired before the transfer finished, and the contract called enter() again (up to two nested calls).
4. The nested deposits were priced against balances that had not been updated yet, so the attacker received excess xn00d. It then called leave() to redeem them for more n00d than it had put in.
5. It repaid the pair and sold the surplus n00d for WETH in four swaps (8.57, 7.13, 4.28 and 0.84 WETH), about 20.82 WETH in total.

Protocol details

Classification NFT / Exchange (DEX) / Token / Reentrancy

Protocol Type Exploit/Reentrancy

Affected asset / contract n00d

Implementation language Solidity

Protocol links Website @n00dleSwap

Evidence

• report @BlockSecTeam incident report twitter.com
• transaction Etherscan transaction 0x8037b3dc...3aea etherscan.io
• address etherscan.io address 0x8ca7…0ff0 etherscan.io
• address etherscan.io address 0x9c5a…9c56 etherscan.io
• analysis DeFiLlama defillama.com
• analysis DeFiHackLabs PoC N00d_exp.sol raw.githubusercontent.com
• analysis DeFiHackLabs 2022 incident list (N00d Token entry) raw.githubusercontent.com

Understand the attack patterns

Compare incidents →

Reentrancy