Utopia Hack

Utopia, a BEP20 reward token on BNB Smart Chain, was exploited on July 20, 2023 for roughly $119K-$120K of WBNB drained from its PancakeSwap liquidity pool.

The token's transfer logic included an _airdrop routine that, on every transfer, derived a series of "random" addresses from public on-chain values and set each one's balance to exactly 1 wei. Because the seed used only the last airdrop address, the block number and the transfer's from/to addresses, an attacker could steer one derived address onto the Utopia/WBNB pair and overwrite the pool's Utopia balance. After syncing the pair, a few wei of Utopia bought almost all of the WBNB reserve. The same _airdrop code was used by the FFIST token, exploited the same day.

**Block data**

• Attacker: 0xe84ef3615b8df94c52e5b6ef21acbf0039b29113
• Attack contract: 0x6191203510c2a6442faecdb6c7bb837a76f02d23
• Vulnerable token: 0xb1da08c472567eb0ec19639b1822f578d39f3333
• Exploit tx: 0xeb4eb487f58d39c05778fed30cd001b986d3c52279e44f46b2de2773e7ee1d5e