What happened
YOLO Games' June 2024 token sale ended after a whitehat exploited an authorization flaw in the Bazaar liquidity pool on Blast. The whitehat withdrew approximately 392 ETH and rYOLO tokens, then returned 353 ETH. YOLO later confirmed that sale participants had been refunded.
Technical root cause
exitPool trusted its sender argument without verifying that the caller owned or was authorized to act for that address. This allowed the factory's withdrawal authority to be impersonated.
How it happened
- The whitehat called BazaarVaultBlast.exitPool with the Bazaar factory address supplied as sender.
- The contract did not verify authority over that sender and released the pool assets.
- The whitehat contacted the team and returned most of the ETH, retaining a reward.
- YOLO ended the sale and refunded participants.
Protocol details
Classification
Protocol Logic / Access Control
Protocol Type
Gaming
Implementation language
Solidity
Protocol links
Website
@YOLO_Blast
Evidence
- report @shoucccc incident report x.com
- analysis DeFiLlama defillama.com
- analysis YOLO Games（Bazaar）事件分析 certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
