Treasure Swap Hack

The Treasure Swap project has been exploited by hackers. Using the vulnerability, the hacker needed only 1 wei to exchange all the $WETH tokens in the transaction pool.

Treasure Swap is a donation protocol driven by the community to build a sustainable DAO.

The hacker noticed a vulnerability in the Treasure Swap contract, where in the swap function the check for the k-value of the constant formula k = a * b, which determines the price of the token (A) in the token (B), was skipped. The hacker noticed this vulnerability, deployed his malicious contracts on the network with which he began to steal the $WETH reserves from the protocol.

Example transactions of the exploit:

1. Tx 0x1328…a0c3
2. Tx 0x90a8…c92d
3. Tx 0x0b13…219c

All stolen $BNB are still held on the hacker's wallet.

Hacker address: Address 0x0FaC…931D

Vulnerable contract addresses:

1. Address 0xe26e…0f88
2. Address 0x96f6…5ec9

Malicious contract addresses:

1. Address 0xd538…1fba
2. Address 0x5baa…e376
3. Address 0xd14c…2016