PolyDEX Hack

The attacker's address:

https://polygonscan.com/address/0x8a0a1eb0…907c6c

The transaction behind the attack:

https://polygonscan.com/tx/0x6b3f0576…ebe3a2

The attacker performed the re-entrance attack on the Token Locker smart contract. The contract itself does not have an issue with standard ERC20, but since the PLX token is ERC777 standard, there will be tokenReceived() callback event every time method transfer() triggered. The attacking smart contract deployed by the hacker has included the unlockAll() trigger repeatedly (40 times) in the event, so he was able to unlock more than the amount he locked in before.

The attacker:

- locked 15,711,384 PLX in the Locker, received 15,711,384 fPLX

- unlocked all 15,711,384 fPLX from the Locker, received 1,184,289 PLX

- in the tokenReceived() called unlockAll() function

- repeated previous step 40 times.

Stolen tokens were sold on USDC, which then were bridged on Ethereum:

https://polygonscan.com/tx/0xe02124b1…6bd1ad