TempleDAO Hack

Reported loss $2.4M
Ethereum
Exploit Lack of Input Authentication

What happened

On October 11, 2022, an attacker drained about 321,154 xFraxTempleLP (xLP) tokens from the StaxLPStaking contract of STAX, a product of the TempleDAO ecosystem on Ethereum. Reported losses were about $2.3 million. The contract's stake-migration function had no access control. It let any caller name any contract as the "old" staking contract and be credited with an arbitrary stake. The attacker removed the LP into TEMPLE and FRAX and swapped the proceeds to about 1,830 ETH, which was moved to another address. Cointelegraph put the loss at about 4% of TempleDAO's $57 million TVL. The team shut down the dApp and said the exploiter could do no further harm. The exploiter's address was linked to a Binance account, and TempleDAO said it was working with Binance on the investigation. Stax offered a white-hat bounty and said it would increase its existing Hats Finance bounty if the funds were returned.

Attacker address: 0x9c9Fb3100A2a521985F0c47DE3B4598dafD25B01 Exploit transaction: 0x8c3f442fc6d640a6ff3ea0b12be64f1d4609ea94edd2966f42c01cd9bdcf04b5 Liquidity removal transaction: 0x4b119a4f4ba1ad483e9851973719f310527b43f3fcc827b6d52db9f4c1ddb6a2

How it happened

  1. migrateStake(address oldStaking, uint256 amount) was meant to be called only by a migrator. It had no onlyMigrator modifier and did not validate oldStaking.
  2. The function called oldStaking.migrateWithdraw(msg.sender, amount) and then credited amount to the caller with _applyStake. It never checked that any tokens had arrived.
  3. The attacker deployed a contract whose migrateWithdraw() did nothing. They called migrateStake() with that contract as oldStaking and an amount equal to the staking contract's full xLP balance.
  4. With the fake stake recorded, the attacker called withdrawAll(false) and received about 321,154 real xLP tokens.
  5. The LP was removed into TEMPLE and FRAX, and the proceeds were swapped to about 1,830 ETH.

Protocol details

Classification Protocol Logic / Yield Aggregator / Access Control
Protocol Type Reserve Currency
Affected asset / contract TEMPLE
Implementation language Solidity
Protocol links Website @templedao

Post-Incident Timeline

  • 2022-10-17

    On 16 October 2022, the stolen amount of 1831 $ETH was moved into TornadoCash from the EOA address Address 0x2b63…b5a0

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes