What happened
On October 27, 2022, UvToken's BNB Chain mining-pool contracts were exploited for more than 5,000 BNB. The attacker used a malicious contract and insufficient validation in the withdrawal path to drain the pool; SlowMist reported 5,011 BNB ultimately moved to Tornado Cash.
How it happened
- The attacker obtained UVT and sent it to the UvToken mining-pool contracts.
- It supplied a malicious contract address to the affected withdrawal path.
- The withdrawal logic accepted attacker-controlled parameters and let the malicious contract return a controllable token amount, draining the vault's UVT balance.
- SlowMist tracked the proceeds as 5,011 BNB sent to Tornado Cash.
Protocol details
Classification
Exchange (DEX) / Access Control
Protocol Type
Exploit/Access control
Affected asset / contract
UVT
Implementation language
Solidity
Protocol links
Website
@UvTokenOfficial
Evidence
- report @BeosinAlert incident report twitter.com
- report Report mobile.twitter.com
- analysis DeFiLlama defillama.com
- analysis Review: UvT Incident Analysis slowmist.medium.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
