Nebula Revelation Hack

Nebula Revelation's staking contract suffered a reentrancy attack, resulting in a loss of 180,264 USD worth 81.3 WETH.

Nebula Revelation, a Web3 space-themed open-world game on Optimism, experienced a reentrancy attack on its staking contract on January 25, 2024. The root cause of the exploit was a lack of reentrancy protection in the withdrawal function of their contracts.Root cause: the withdrawNFL() did not have re-entry protection. The attacker used a self-destructing contract to complete all operations in one transaction, exploiting the security vulnerability.

The stolen funds, amounting to 180,264 USD worth 81.3 WETH, were transferred and bridged to the Ethereum chain.

Attacker Address:

Address 0x1fd0…ef12

Malicious Transaction:

Tx 0xf4fc…2328

Malicious Contract Address:

Address 0xE4D4…087b

Self Destruct Contract Address:

Address 0xfc3b…Ba4C

Hop Protocol, Bridged Transaction:

Tx 0x48be…99cb