What happened
PolBase Cash was an algorithmic stable coin project that contained unverified smart contracts which empowered the contract deployer to withdraw funds from the operation. Investors were deprived of $350k.
PolBase Cash an algorithmic stable coin project that boasted three coins. $PBC (PolBase Cash) was the dollar pegged stable coin. In order to enable stabilization mechanisms $PBB (PolBase Bonds) and $PBS (PolBase Share) were introduced, similar to the popular Tomb Finance protocol on the Fantom network.
The contract deployer created four smart contracts for staking $USDT, $USDC, DAI and LP tokens separately. The staking contracts were unverified, meaning the code was not visible on the block explorer for everyone to review.
The contract deployer interacted with these 4 smart contracts using function setOperation() with the below address as input data:
This address received permission to withdraw funds from the staking smart contracts. The stolen funds were then transferred to a variety of external wallets. In addition, the liquidity from the pair was removed by this address as well:
USDT staking contract:
USDC staking contract:
DAI staking contract:
LP contract:
Outgoing transactions could be found at:
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
