wDAO EON Hack

On June 2, 2023, an attacker drained about $29,195 in USDT from a swap contract on Polygon that exchanged USDT for NST (Instante) at a fixed rate. PeckShield flagged the victim as wDAO EON with about $30K lost. DeFiHackLabs calls the same attack "NST Simple Swap" and says the software company Milktech built NST as a token held at a constant USD price. The swap contract offered buyNST and sellNST functions, and its source code was never verified.

DeFiHackLabs files the bug as a wrong approval. After a buy and a sell, the swap contract had left the attacker's contract with a USDT allowance, and the attacker used transferFrom to pull an extra 31,559 USDT out of it. The attacker funded the round trip with a 40,000 USDT Balancer flash loan and repaid it in the same transaction.

The address that collected the profit was not the first to try. Another address sent an attack transaction in the same second and it reverted, which fits reports that the original exploiter was front-run by a bot.

**Block data**

• Attacker (front-runner): 0xcb3585f3e09f0238a3f61838502590a23f15bb5b
• Initial attacker: 0xb3d204ee119547faa7be6796a31ca773c24b1fdc
• Attack contract: 0x3bb7a0f2fe88aba35408c64f588345481490fe93
• Swap contract: 0x9D101E71064971165Cd801E39c6B07234B65aa88
• Exploit transaction: 0xa1f2377fc6c24d7cd9ca084cafec29e5d5c8442a10aae4e7e304a4fbf548be6d
• Failed transaction (initial attacker): 0x0ef500ef64e6921eb80d69dddbcd662eb9c52a2e0e147943a33e2df989fd294d