HACK ANALYSIS 2 min read

Pawnfi Hack Analysis

Overview

On June 17, 2023, Pawnfi was hacked due to a business logic vulnerability, leading to an approximate loss of 820K USD.

Smart Contract Hack Overview:

Attacker address: 0x8f7370

Vulnerable contract: 0x85018C

Attack Transaction: 0xe855cc

Decoding the Smart Contract Vulnerability:

The root cause of the attack was due to a failure of the protocol to verify whether the NFT had actually been transferred when users used a specified NFT as collateral for borrowing.
The attacker took advantage of the contract by borrowing APE tokens using an NFT that was already staked in the APE Staking Pool.
The APE tokens borrowed by the attacker were then moved and held within the project contract.
Afterward, the attacker triggered the depositAndBorrowApeAndStake() function again, causing the contract to stake the APE tokens in the APE Staking Pool.

Fig: The root cause of the vulnerability

Unfortunately, the contract incorrectly identified the newly staked funds as being deposited by the attacker.
Consequently, the attacker gained direct access to invoke the withdrawApeCoin() function, allowing them to withdraw the APE tokens and make a profit.

Mitigation and Best Practices:

Always validate your code by writing comprehensive test cases that cover all the possible business logic.
To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://credshields.com/
Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detections at SolidityScan

Cloud-based Smart Contract Security Scanner

Conclusion:

SolidityScan is an advanced smart-contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup

Pawnfi Hack Analysis