SudoRare Hack

The owner of SudoRare contracts used privileges and transferred all deposited assets from SudoRare Pools. The contracts contained security issues as minting and privileges to freely transfer any types of assets from the pools contract were accessible by the owner.

SudoRare was a NFT platform with staking features using $XMON, $LOOKS and $ETH assets. After reaching certain amount of assets, the owner of the SudoRareGenesisPool contract used his privileges to withdraw funds including 6 $XMON (125.4 $ETH), 1,115,216 $LOOKS (192 $ETH) and 200 $wETH. After the withdrawal, all assets were sold on UniSwap for $wETH. The total of the ill-gotten funds amounted to 517,4 wETH, which were transferred to three newly added addresses.

Subsequently, a huge amount of $SR tokens (87.7 % of total supply) was transferred to another address. Official site sudorare.xyz has been downed and social accounts have been deleted.

Affected contract address: https://etherscan.io/address/0x8c4e4633…F6e905

Address of scammer: https://etherscan.io/address/0xbb42f789…389d8A

Public addresses of three current holders of rugged wETH:

https://etherscan.io/address/0x0498d16a…b68074

https://etherscan.io/address/0xbFb7840e…777EAa

https://etherscan.io/address/0x75c3b271…Bc3981

Transaction (Project deployer withdrawing funds)

https://etherscan.io/tx/0x78d9a54c…7a819b

Source code:

https://etherscan.io/address/0x8703ff2b…f159d4#code