What happened
On January 18, 2023, Thoreum Finance's newly upgraded v4 token contract was exploited, with CertiK estimating a loss of about 2,260 WBNB. CertiK assessed the post-upgrade implementation as likely flawed when a transfer used the same address as both sender and recipient, allowing the sender's balance to increase by the transferred amount. The updated implementation was unverified, so the precise source code and complete exploit path remain unconfirmed.
How it happened
- Thoreum Finance deployed a new v4 token implementation on January 18.
- CertiK's reconstruction found that the unverified implementation likely mishandled a transfer where the sender and recipient were the same address.
- Under that condition, the sender's token balance could increase by the transfer amount.
- The attacker used the resulting manipulated balance to obtain value, with CertiK estimating about 2,260 WBNB lost.
Protocol details
Classification
Other / Protocol Logic
Protocol Type
Yield
Affected asset / contract
THOREUM
Implementation language
Solidity
Protocol links
Website
@ThoreumFinance
Security review history
- TechRate View report
- Paladin Security View report
- CertiK View report
Evidence
- report Report hacked.slowmist.io
- report Report panewslab.com
- report Report neptunemutual.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Post Mortem: Thoreum Finance certik.com
- analysis DappBay: Red Alarm dApp Risk-List (Jan. 20th - Jan. 27th) bnbchain.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
