SafeMoon's Smart Contract Exploit: An $8.9M Heist and Unexpected Return of Funds

Summary #

In March 2023, SafeMoon, a DeFi protocol, experienced a significant security breach when a vulnerability in its contract allowed an attacker to steal approximately $8.9 million. The attacker exploited unprotected burn and mint functions, essentially manipulating the value of the SFM token. In a surprising turn of events, the attacker agreed to return 80% of the stolen funds, retaining the remaining 20% as a bug bounty.

Attackers #

The attacker’s identity remains unknown. The following BSC addresses were involved in malicious actions:

• 0x286e09932b8d096cba3423d12965042736b8f850

Losses #

• 28k BNB (~$8.9 million)

Source

Timeline #

• March 28, 2023, 07:26:27 PM +UTC: An attacker exploits smart contract vulnerability. They burn a significant amount of SFM tokens from the SFM/BNB liquidity pool, which drastically increases the price of SFM tokens in the pool. They then sell previously acquired SFM tokens into this skewed pool, draining it of BNB liquidity and making a profit of 28k BNB or $8.9M.
• March 29, 2023: The attack was announced by the project and its CEO, John Karony, with replies disabled on both tweets.
• March 29, 2023: The attacker contacts ( one, two) the Safemoon Deployer address claiming to be an MEV bot operator who accidentally front-ran an attack. They offer to return the funds.
• April 20, 2023, 03:28:11 AM +UTC: Exploiter has transferred 10,000 $BNB (~$3.4M) to SafeMoon Treasury Wallet
• April 20, 2023, 04:24:00 AM +UTC: Exploiter has transferred 11,804 $BNB (~$4.0M) to SafeMoon Treasury Wallet

Security Failure Causes #

• Unprotected burn and mint functions: The recent updates to the SafeMoon contract introduced burn and mint functions that were not properly protected. This allowed the attacker to manipulate the value of the SFM tokens in the liquidity pool.
• Potential private key compromise: The presence of such elementary errors in the contract updates suggested that there could have been a compromise of a private key, which may have allowed the malicious update.