Incident Overview
The SuperStep project was rugpulled by the team that worked on it. The team created a staking platform, offering a high annual income from staking. The project entailed a backdoor in the contract, allowing the creator address to withdraw all of the staked $BNB within the protocol.
SuperStep is a fitness DAPP empowered by Jog-to-Earn mechanism.
The scammers created contracts to attract investors to their project. In order to make the token valuable, they created a pair on PancakeSwap in this transaction:
https://bscscan.com/tx/0x83275f17…d69acc
Then they made an airdrop, which attracted even more investment in the project:
https://bscscan.com/txsInternal?a=0xc54b1292…8d54ea&p=92
When funds were deposited into the staking contract, scammers began to withdraw funds:
https://bscscan.com/address/0xaef547a5…444885#internaltx.
Funds were laundered via Tornado.cash.
As the time of this writing information on this case is scarce. More sources will be added if the case should develop.
Involved address:
Scammer address (A): https://bscscan.com/address/0xaef547a5…444885
Scammer address (B): https://bscscan.com/address/0x52c586c2…f2caac
Scammer address (C): https://bscscan.com/address/0xd2f7fd26…67e812
Liquidity pool creation transaction: https://bscscan.com/tx/0x83275f17…d69acc
Contracts interacted with:
Token address: https://bscscan.com/address/0x6f7a8827…b5b55f
Gem address: https://bscscan.com/address/0x594b5d76…f65633
Unverified contract addresses:
1) https://bscscan.com/address/0x948213ed…25d2c0
2) https://bscscan.com/address/0x948213ed…25d2c0
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to SuperStep, these are the critical security checks that could have prevented this incident (July 2022).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
-
01
Source 1 https://www.superstep.org/staking
- 02
Learn to Prevent the Next SuperStep
The SuperStep hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.