According to reports, a BNB Chain DEX router suffered the loss of 62.28 WBNB due to exploitation of token approvals that already existed. Security researcher ExVul shared this news on September 7 via X. The security researcher indicated that 29 wallets lost approved tokens. This reported hack did not involve any private key or admin access, or even price manipulation.
False Pool Uses Previous Approvals for Attack
According to ExVul, the hacker’s actions had to do with the router executing the swap callback in the Uniswap V3 manner. The researcher noted that the uniswapV3SwapCallback received the address of the payer given by the caller, and then supposedly used the transferFrom() method to withdraw tokens from the payer’s address.
Moreover, the researcher indicated that there was no validation of the origin of the callback in the authorized V3 liquidity pool because the factoryV3 settings were zero. That supposedly meant that the verification did not take place. Thus, it allowed the attacker to impersonate the legitimate V3 liquidity pool using another contract and execute the swap callback in the router. It started with just one WBNB that the hacker borrowed using the flash swap in PancakeSwap.
The fake pool contract was then set up by the attacker. After that, the attacker invoked the router, specifying the victim as the payer. As a result, the fake pool invoked the callback and gave the router access to the victim’s allowance. The attacker moved the approved tokens, converted the received funds to BNB, and paid back the original flash swap. The rest of the funds remained with the attacker.
The Attack Demonstrates Vulnerability to Approvals
In the above-mentioned hack, the approval of token allowances is exposed as a vulnerability that can be used against users. Indeed, users typically allow routers to spend their tokens while conducting transactions on decentralized exchanges. These permissions can be valid until they are changed by the user.
ExVul explained that the alleged exploit would impact wallets that had been granted permission by the router previously. A total of 29 wallets were found to be affected. Those users who have interacted with the contract should review their permissions going forward as investigations proceed. It is not possible to retrieve the assets once they have been transferred. The BNB Chain activity is still high, as indicated by Dune Analytics data.
ExVul identified the reported router as 0xa331fde028e6F17425AB9333c39ae43722340d24.
The reported attacker address was 0xB929C7215c0ec8EbAD5fBf73b1Da63bccfFf1896.
The attack transaction was 0x40eb22369da422a8275d5679054aa3a8c8906d93abc0bac3a3f2cad879389319.
There had been no verification by the router team of the claims of ExVul. The whole scope of the hack, including the tokens and the approvals involved, was still unknown. It is also worth noting that this hack does not have much to do with the previously reported hack of August, in which a sum of $907,700 MOKE was stolen through manipulation.
Highlighted Crypto News:
Coldcard Hacker Moves 45% of Stolen Bitcoin Through THORChain
