How Akutar NFT loses 34M USD

We find there exist two serious logic vulnerabilities in the @AkuDreams contracts(https://etherscan.io/address/0xf42c318dbfbaab0eee040279c6a2588fa01a961d). The first vulnerability can cause a DoS attack and the second vulnerability will make the project fund (more than 34M USD) being locked forever.

Vulnerability I

The first vulnerability exists in the processRefunds function. This function has a loop that will refund each bid user's fund. However, the bidder can be a malicious contract that reverts the transaction. This can cause the invocation of processRefunds revert, and none of user's refunds can be successful. Fortunately, this vulnerability has not been exploited.

We suggest that the contract can take the following measures to refund users.

  • Ensure that only EOA can bid
  • Use ERC20 token, e.g., WETH, instead of ETH
  • Has function that allows a user to get the refund by himself

Vulnerability II

The second vulnerability is a software bug. In the claimProjectFunds function, the project owner can claim the Ether in the contract. However, the require statement require(refundProgress >= totalBids, "Refunds not yet processed"); has a bug, which should compares the refundProgress with _bidIndex instead of totalBids. Due to this vulnerability, the requirement will never be satisfied, and the Ether (11,539.5 Ether) in the contract can be locked for ever.

Summary

We are surprised again (after the NBA NFT case yesterday) that how a high-profile project can neglect the basic software security practice. At least, the project should write enough test cases. Unfortunately, we suspect that the projects are too busy to write the test cases, and lose 34M USD forever.

About BlockSec

The BlockSec Team focuses on the security of the blockchain ecosystem, and collaborates with leading DeFi projects to secure their products. The team is founded by top-notch security researchers and experienced experts from both academia and industry. They have published multiple blockchain security papers in prestigious conferences, reported several zero-day attacks of DeFi applications, and released detailed analysis reports of high-impact security incidents.

--

--

--

A Blockchain Security and Data Company.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

QUESTIONNAIRE INTO CRYPTOGRAPHY YOURSELF.

A Pentester’s Favorite Vulnerability Scanning Tools

Q&A: Cybersecurity Month

Remote Login with SSH

Google Account for Everyday Tasks

postImage

{UPDATE} PopStar Pro! HD Hack Free Resources Generator

CISOs On the Tight Rope — An Interview with Simon Gibson, CISO at Gigamon

Meet Our Partners: Electrik Finance

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
BlockSec

BlockSec

A Blockchain Security and Data Company.

More from Medium

How to verify a signature in a wrong way — the AssociationNFT case

The difference between bytecode and deployed bytecode

How Scammer Used Malicious Bookmark to Gain Access to Discords of NFT projects

How to Code a PayNow Function with Solidity: The 3 Must-Know Smart Contract Methods