Safe Dollar Hack

The attacker's address:

Address 0x8a0a…7c6c

The attack transaction:

Tx 0x76c7…b210

The re-entrance attack on the Token Locker smart contract was performed, Safe Dollar share tokens were affected.

The contract itself does not have an issue with standard ERC20, but since the PLX token is ERC777 standard, there will be tokenReceived() callback event every time method transfer() triggered. The attacking smart contract deployed by the hacker has included the unlockAll() trigger repeatedly (40 times) in the event, so he was able to unlock more than the amount he locked in before.

The attacker withdrew 9,959.26 SDS, then sold for 95,392 USDC after bridging all to Ethereum.