RocketSwap Base Hack

RocketSwap, a DEX on Base chain, suffered an access control exploit on Aug 14, 2023, leading to a loss of 472 ETH, equivalent to 869,000 $USD.

On Aug 14, 2023, RocketSwap, a decentralized exchange operating on the Base chain, fell victim to an access control exploit. The attacker managed to compromise the RocketSwap: Deployer EOA address, allowing them to seize LP tokens. After acquiring these tokens, the attacker removed liquidity and converted RCKT, WETH, and axlUSDC tokens to ETH, which were then bridged to the Ethereum Mainnet via Stargate Bridge.

Once on the Ethereum chain, the attacker used the funds to add liquidity along with a newly created fake token, LoveRCKT. Half of the liquidity with the fake token was already withdrawn as of August 15, 2023. The attack resulted in a total loss of approximately 472 ETH, worth around 869,000 $USD. RocketSwap's team confirmed that there was a brute force attack on their server where the private keys were stored, and subsequently shut down their Telegram and disabled comments.

Attacker Address:

https://basescan.org/address/0x96c0876F…B13DE8

Malicious Transaction:

https://basescan.org/tx/0x25c11d66…f9bfba

Liquidity Removal Transactions:

https://basescan.org/tx/0x5dce5276…50c5b5

https://basescan.org/tx/0x1a1d567e…179ada

Bridging Transaction:

https://basescan.org/tx/0x9b384f72…8de026

Funds Holder as of Aug 15, 2023:

https://etherscan.io/address/0x96c0876F…B13DE8

Fake Token Address:

https://etherscan.io/address/0xbdacbd34…841a39

Liquidity Adding Transaction:

https://etherscan.io/tx/0xbe0b8918…4f3dba

Liquidity Removal Transaction:

https://etherscan.io/tx/0xf1a95e4d…432220