What happened
The hacker attacked Umbrella Network's reward pools, causing $700,000 to be siphoned from both BNB Chain and Ethereum.
On March 20, 2022, Umbrella Network revealed that the LP tokens staked in their Polar Stream staking contracts on Ethereum and BNB Chain had been drained from both contracts. According to reports, the hacker then used the stolen LP tokens to withdraw liquidity from both the UMB-ETH Uniswap and the UMB-BNB Pancakeswap pools.
The hack is possible because of an unchecked underflow in withdraw() so that anyone can withdraw any amount even without any balance.
Case & protocol details
Classification
Other / Access Control
Protocol Type
Oracle
Affected asset / contract
UMB
Smart Contract Language
Solidity
Official Website
umb.network/
Protocol Twitter/X
@UmbNetwork
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Post-mortem medium.com
- report Report twitter.com
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.