OMNI Real Estate Hack

Reported loss $70K
BNB Chain
Other

What happened

OMNI Real Estate Token (ORT) on BNB Chain lost about $70,000 on January 17, 2023, through its staking contract. The attacker earned roughly 236 BNB (SolidityScan reports 256 BNB).

invest(end_date, qty_ort) in the StakingPool contract accepted an end_date of 0. That value becomes the lock duration passed to _Check_reward(), which picks a reward rate through a chain of if/else duration checks. None of the branches handled a duration of 0, so the function fell through and returned the full total_percent. The attacker staked 1 wei of ORT with end_date 0, withdrew straight away with withdrawAndClaim() for a large ORT reward, repeated this, and swapped the ORT for BNB on PancakeSwap.

**Block data**

  • Attacker addresses: 0x9bbd94506398a1459f0cd3b2638512627390255e, 0xda5919bf3a49ad47b7c7103a9ed3902cee78d528
  • Attack contract: 0xdD87D807774c8aA9D70FC6aF5912C97FaDBF531B
  • Invest transaction: 0x49bed801b9a9432728b1939951acaa8f2e874453d39c7d881a62c2c157aa7613
  • Withdraw transaction: 0xa916674fb8203fac6d78f5f9afc604be468a514aa61ea36c6d6ef26ecfbd0e97
  • ORT token: 0x1d64327C74d6519afeF54E58730aD6fc797f05Ba

How it happened

  1. The attacker bought a small amount of ORT on PancakeSwap.
  2. It called invest(0, 1) on the StakingPool, staking 1 wei of ORT with an end_date of 0. The contract did not reject the zero value.
  3. It called withdrawAndClaim() on the new stake right away. _Check_reward() received a duration of 0, matched none of its duration branches, and returned the full total_percent, so the claim paid out a large amount of ORT.
  4. It repeated the invest-and-withdraw cycle to collect more ORT.
  5. It sold the ORT for BNB on PancakeSwap, netting roughly 236 BNB (about $70,000).

Protocol details

Classification NFT / Input Validation
Protocol Type Exploit/Other
Affected asset / contract ORT
Implementation language Solidity
Protocol links Website @omniestategroup

Evidence

Same attack technique

Browse all hacks →
Ethereum Socket $3.3M lost Ethereum Time $200K lost Optimism Polynomial Protocol $7K lost BNB Chain Sheep Farm $91K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes