SolidityScan
HACK ANALYSIS 2 min read

SHIDO Hack Analysis

SHIDO Hack Analysis

Overview:

On June 23, 2023, Shido suffered an attack, due to a business logic vulnerability, leading to a loss of ~977WBNB.

Smart Contract Hack Overview:

Fig: Attack Transaction

Decoding the Smart Contract Vulnerability:

  • The attacker initiated a flash loan and borrowed 40 WBNB.
  • They swapped 39 WBNB to acquire a significant amount of Shido Inu: SHIDO Token (9 decimal places) in the PancakeSwap V2: SHIDO-WBNB pool.
  • The attacker used the ShidoLock contract’s lockTokens and claimTokens functions to convert the acquired SHIDO tokens into a more significant amount of SHIDO tokens.
  • Due to the configuration error of the ShidoLock contract (the unlock time is fixed at 14:00 on June 23, 2023, regardless of the collateral time), the attacker can immediately unlock and obtain a large number of v2 tokens.
Fig: The root cause of the vulnerability
  • Exploiting a price difference between the PancakeSwap V2: SHIDO-WBNB pool and the PancakeSwap V2: SHIDO pool, the attacker exchanged the increased SHIDO tokens for 1,016 WBNB (compared to the initial 40 WBNB used in the first swap).
  • Finally, the attacker repaid the 40 WBNB flash loan and generated a profit of approximately 976 WBNB

Mitigation and Best Practices:

  • Always validate your code by writing comprehensive test cases that cover all the possible business logic.
  • To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://credshields.com/
  • Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detections at SolidityScan
SolidityScan — Smart Contract Vulnerability Scanner

Conclusion:

SolidityScan is an advanced smart-contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup

Follow us on our Social Media for Web3 security-related updates.
SolidityScan — LinkedIn | Twitter | Telegram | Discord

Themis Protocol Hack Analysis
CS Token Hack Analysis