Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Thursday December 02 2021, @02:54PM   Printer-friendly
from the a-few-bugs-still-need-ironing-out dept.

Really stupid "smart contract" bug let hackers steal $31 million in digital coin:

Blockchain startup MonoX Finance said on Wednesday that a hacker stole $31 million by exploiting a bug in software the service uses to draft smart contracts.

The company uses a decentralized finance protocol known as MonoX that lets users trade digital currency tokens without some of the requirements of traditional exchanges. "Project owners can list their tokens without the burden of capital requirements and focus on using funds for building the project instead of providing liquidity," MonoX company representatives say here. "It works by grouping deposited tokens into a virtual pair with vCASH, to offer a single token pool design."

An accounting error built into the company's software let an attacker inflate the price of the MONO token and to then use it to cash out all the other deposited tokens, MonoX Finance revealed in a post. The haul amounted to $31 million worth of tokens on the Ethereum or Polygon blockchains, both of which are supported by the MonoX protocol.

Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX updates prices after each swap by calculating new prices for both tokens. When the swap is completed, the price of tokenIn—that is, the token sent by the user—decreases and the price of tokenOut—or the token received by the user—increases.

By using the same token for both tokenIn and tokenOut, the hacker greatly inflated the price of the MONO token because the updating of the tokenOut overwrote the price update of the tokenIn. The hacker then exchanged the token for $31 million worth of tokens on the Ethereum and Polygon blockchains.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1) by davidjohnpaul on Thursday December 02 2021, @10:08PM (1 child)

    by davidjohnpaul (5377) on Thursday December 02 2021, @10:08PM (#1201656) Homepage

    The MonoX platform did exactly what the smart contract specified. Why should the "hackers" know this is not what MonoX intended?

  • (Score: 2, Insightful) by Anonymous Coward on Thursday December 02 2021, @10:50PM

    by Anonymous Coward on Thursday December 02 2021, @10:50PM (#1201673)

    Indeed, this is not a hack. This is profitable noticing.