OTSea Hack

Reported loss $26K
Ethereum
Reward Logic Flaw

What happened

OTSea is an OTC (peer-to-peer) crypto trading platform. On September 13, 2024, an attacker drained its OTSeaStaking contract on Ethereum of 43,944,445 OTSea tokens, almost everything the contract held, for a loss of about $26,000. The staking contract marked a withdrawn deposit as spent only by setting its rewardReferenceEpoch to 0, and it never zeroed the deposit amount. claim() set rewardReferenceEpoch to the current epoch for every index passed in, without checking whether the deposit had already been withdrawn. That brought spent deposits back to life, so the attacker could withdraw the same principal again and again. The attacker sold 6 million of the drained OTSea for 10.94 ETH on Uniswap V2.

Exploit transaction: 0x90b4fcf583444d44efb8625e6f253cfcb786d2f4eda7198bdab67a54108cd5f4. Attacker: 0x000000003704BC4ffb86000046721f44Ef3DBABe. Attack contract: 0xd11eE5A6a9EbD9327360D7A82e40d2F8C314e985.

How it happened

  1. The attacker's staking position already held a set of OTSea deposits. withdraw() returned a deposit's principal and set its rewardReferenceEpoch to 0, the only marker that it was spent.
  2. The attacker called claim() on a list of deposit indexes that included withdrawn ones. _claimMultiple wrote rewardReferenceEpoch = currentEpoch for each index without a liveness check, re-arming the withdrawn deposits with their full amount still recorded. Each list also included one deposit with pending rewards, which kept claim() from reverting with NoRewards.
  3. It then called withdraw() on the same indexes. The re-armed deposits passed the rewardReferenceEpoch == 0 check and paid out their principal a second time.
  4. Repeating claim() then withdraw() in 46 loops pulled 43,944,445 OTSea out of the 43,944,819 the contract held, taking other stakers' tokens.
  5. The attacker swapped 6 million OTSea for 10.94 ETH on Uniswap V2.

Protocol details

Classification Protocol Logic
Protocol Type DEX
Implementation language Solidity
Protocol links @otseaERC20

Security review history

Evidence

Same attack technique

Browse all hacks →
BNB Chain Grizzifi $61K lost Ethereum Sorra Finance $41K lost BNB Chain FFIST $110K lost BNB Chain UEarnPool $16K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes