What happened
Wrapped XETA (WXETA) lost about $110K on BNB Smart Chain on September 15, 2024. Its initialize function never set the flag that should stop it from being called again. An attacker called it again, gave itself minting rights, minted a huge amount of WXETA straight into the PancakeSwap stablecoin/WXETA pair, and swapped out almost the whole stablecoin reserve.
**Block data**
- Attacker:
0x57ecf40b596274a985967e3f698437ae0a9600a0 - Attack contract:
0x11bffb96daa9b0c47fef01401eb089549e87604e - Vulnerable contract:
0x05c2dd9cf547c6cccf91245346e6e1bc9926cae7 - Exploit tx:
0x614da880bd46e98131accd9a83917abf3d56dac94caf13ae98eeff504eea3704
How it happened
- The attack contract called
initializeon the WXETA diamond contract. Because the function did not mark the contract as initialized, it could be called again, and the attacker took control of minting. - It called
mintto create 10^15 WXETA directly in the PancakeSwap pair. - It called
swapon the pair to pull out nearly all of the pair's stablecoin reserve against the freshly minted WXETA. - It sold the stablecoin for BNB through the PancakeSwap router, sent the proceeds to the attacker and self-destructed.
Protocol details
Classification
Protocol Logic / Access Control
Protocol Type
DeFi Protocol
Implementation language
Solidity
Evidence
Proof of concept
1 available- Code WXETA Logic Flaw
Sources
- report Twitter/X Alert x.com
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs WXETA_exp.sol (2024-09 PoC) raw.githubusercontent.com
- analysis DeFiHackLabs 2024 incident list (20240915 WXETA - Logic Flaw) raw.githubusercontent.com
- analysis Web3 Security Auditor's 2024 Rewind (OpenZeppelin) openzeppelin.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
