PolBase Cash Hack

PolBase Cash was an algorithmic stable coin project that contained unverified smart contracts which empowered the contract deployer to withdraw funds from the operation. Investors were deprived of $350k.

PolBase Cash an algorithmic stable coin project that boasted three coins. $PBC (PolBase Cash) was the dollar pegged stable coin. In order to enable stabilization mechanisms $PBB (PolBase Bonds) and $PBS (PolBase Share) were introduced, similar to the popular Tomb Finance protocol on the Fantom network.

The contract deployer created four smart contracts for staking $USDT, $USDC, DAI and LP tokens separately. The staking contracts were unverified, meaning the code was not visible on the block explorer for everyone to review.

The contract deployer interacted with these 4 smart contracts using function setOperation() with the below address as input data:

0x5C0D86B9…5d52eA.

This address received permission to withdraw funds from the staking smart contracts. The stolen funds were then transferred to a variety of external wallets. In addition, the liquidity from the pair was removed by this address as well:

https://etherscan.io/tx/0xbf17223d…1d62fc

USDT staking contract:

https://etherscan.io/address/0x4f2582fe…e3381b

USDC staking contract:

https://etherscan.io/address/0x2b3e2fe7…025bc3

DAI staking contract:

https://etherscan.io/address/0xa72180b8…3faf2c

LP contract:

https://etherscan.io/address/0x386e747a…8b63a9

Outgoing transactions could be found at:

https://bloxy.info/address/0x5c0d86b9…5d52ea