What happened
SheepFarm, an investment-style blockchain game on BNB Chain, was exploited on November 15, 2022. The contract's register() function could be called again and again by the same account. Each call credited new-user gems, which the attacker converted into BNB taken from the game contract.
SolidityScan and Neptune Mutual estimate the loss at about 262 BNB (about $72,000). The existing record lists 309 BNB, then valued at $91,320. This draft does not resolve the difference.
Attacker: 0x2131c67ed7b6aa01b7aa308c71991ef5baedd049
SheepFarm contract: 0x4726010da871f4b57b5031e3ea48bde961f122aa
Example exploit transaction: 0x8b3e0e3ea04829f941ca24c85032c3b4aeb1f8b1b278262901c2c5847dc72f1c
How it happened
- The attacker called SheepFarm's
register()repeatedly. Each call passed the new-user check and added the registration gem bonus. - The attacker spent the accumulated gems and resources in
upgradeVillage()to raise the account's yield. - The attacker called
sellVillage()to turn that yield into BNB paid out by the game contract.
Protocol details
Evidence
- report Report blog.neptunemutual.com
- transaction bscscan.com transaction 0x8b3e…2f1c bscscan.com
- address bscscan.com address 0x2131…d049 bscscan.com
- address bscscan.com address 0xf2db…6bbc bscscan.com
- analysis DeFiLlama defillama.com
- analysis Sheep Farm Hack Analysis — Incorrect Registration Implementation blog.solidityscan.com
- analysis Decoding Sheep Farm Smart Contract Hack neptunemutual.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
