Safe Dollar Hack

The attacker's address:

https://polygonscan.com/address/0xfedc2487…be7ebd

The attack transaction:

https://polygonscan.com/tx/0x1360315a…ee5c14

The attack took the use of a flaw in Safe Dollar reward structure to alter the accSdoPerShare value, allowing it to claim a big number of SDO for each token deposited token.

In preparation, an initial deposit was placed into one of the protocol's Safe Farms:

https://polygonscan.com/tx/0x55dad44a…3a074b

Transfer fees are charged by PLX, the currency that SafeDollar was incentivizing. These fees are meant to be borne by the user, however, they were taken from the rewarder balance instead during withdrawal transactions.

The hacker used a deposit/withdraw loop to progressively drain the pool's PLX balance over the course of 101 transactions, resulting in a hugely inflated accSdoPerShare of 1,142,913,215,739,484,400 SDO being awarded for each PLX contributed.

Claiming rewards on the initial deposit produced a total of 831,309,277,244,108,000 SDO which were sold by the attacker.