Ragnarok Online Invasion Hack
What happened
On September 8, 2022, the BNB Smart Chain ROI token for Ragnarok Online Invasion was exploited through an ownership-transfer access-control failure. An unauthorized caller took control of the token contract, exchanged ROI through the liquidity path, and withdrew approximately 162.5 BNB. Contemporary security analysis valued the withdrawn assets at about $47,384 and reported a near-total collapse in the token price.
The ownership-transfer function lacked an effective onlyOwner or equivalent administrator check, allowing an arbitrary caller to obtain privileged control. Any function that changes owner, governor, minting, pausing, or withdrawal authority must enforce a single verified authority, emit and monitor ownership changes, and be tested from an unprivileged caller.
How it happened
- The ROI token contract exposed its ownership-transfer path without an effective ownership or administrator restriction.
- The attacker called the vulnerable path to transfer token-contract control to an attacker-controlled address.
- With privileged control in hand, the attacker carried out a series of swaps from ROI to BUSD and then BNB, before calling the withdrawal function.
- The final withdrawal removed roughly 162.5 BNB from the affected liquidity path.
- This was not an access-control bypass of a correctly protected administrator: the contract’s ownership-transfer function itself failed to enforce who could invoke it.
Protocol details
Evidence
- report Report archive.is
- transaction BscScan exploit transaction bscscan.com
- address BscScan compromised ROI token contract bscscan.com
- analysis DeFiLlama defillama.com
- analysis ImmuneBytes detailed ROI hack analysis immunebytes.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
