PolkaTrain Hack

Around 3:00 a.m. UCT + 8 on April 5, 2021, the smart contract of Polkatrain was attacked by hackers during the LBP auction, 57000 DOT were stolen in the contract and turned away.

The LBP contract has a swap function and a rebate mechanism. When users buy PLOT tokens through the swap function, they get a certain amount of rebates, and the rebates will be It is sent to the user by calling transferFrom in the _update function in the contract. Since the _update function does not set the maximum amount of rebates in a pool, nor does it determine whether the total rebates are used up when rebates, malicious arbitrageurs can continue to call the swap function to exchange tokens to get the contract.