WebKeyDao Hack

On March 15, 2025, WebKeyDao was exploited for ~$737K due to an unprotected buy function in the contract 0xD5110...CD851.

On March 15, 2025, an attacker exploited a vulnerability in WebKeyDao’s smart contract 0xD5110...CD851, which lacked proper protection in its buy function. By using 1,159 BUSD, the attacker minted 230 wkeyDao tokens at a highly favorable rate. These storage values were set using the SetSaleInfo function, modifying storage slots 0x9c and 0x9e, which controlled token pricing.

The attacker then sold the 230 tokens for 13,167 BUSD on a decentralized exchange (DEX), making a 10x profit. Despite the vulnerability, the contract had a 67-token sale threshold, preventing a full drain of the $11M liquidity pool. Initially, the loss was estimated at $73K, but after further analysis, the total stolen funds were confirmed to be ~$737K.

The vulnerable contract is no longer exploitable, and full details have been disclosed to the community.