Rubixi Hack

Rubixi contract had a security issue, which allowed anyone to become a contract owner and withdrew fees.

Rubixi was a project on the Ethereum chain designed to collect funds and had a privileged function to collect fees. The contract itself had a logic issue, which allowed anyone to become a contract owner and withdraw fees for themselves. The constructor of the contract was named wrong and become a regular function.

After becoming a contract owner, anyone can call the unprotected function collectAllFees() to withdraw fees. The contract currently has only 4 $ETH, which is stuck and can't be withdrawn.

Deployment transaction:

https://etherscan.io/tx/0x4496b642…8f8ec3

Contract deployer:

https://etherscan.io/address/0xdd68da49…68ad60

Owner change example:

https://etherscan.io/tx/0x9385dca4…10684c

Withdrawal example:

https://etherscan.io/tx/0x580222b0…7dd472