SafeMoon’s Upgrade Facilitated its Exploitation, Says Analyst

According to the latest data, it appears that the blockchain platform SafeMoon’s exploitation was facilitated by the platform’s recent upgrade that introduced a “public burn bug.”

On March 29, the on-chain analytic platform PeckShield Inc. shared a Twitter thread on its official page, declaring that the upgrade’s public burn bug led to the exploit, supposedly initiated by an admin key leak:

Hi @safemoon The upgrade, with the exploited public burn bug, was initiated by the official SafeMoon: Deployer. (Admin key leak?) And here comes the upgrade tx. https://t.co/ffAhm9qhgG https://t.co/KYEiYxMRII pic.twitter.com/9CQhseircP

— PeckShield Inc. (@peckshield) March 28, 2023

Previously, it was revealed that nearly $9 million in tokens were drained out of the exchange following the exploitation when the attackers manipulated a fabricated feature on the platform’s smart contracts.

Subsequently, SafeMoon updated its Twitter page with the information that the platform’s liquidity pool has been compromised, adding:

We want to inform you that our LP has been compromised. We’re taking swift action in an attempt to resolve the issue as soon as possible… Thank you for your support as we work to address this situation.

According to PeckShield, the hacker manipulated the price of the SFM tokens using a code function and facilitated the sale of enough tokens back to the liquidity pool resulting in the extraction of the remaining WBNB in the pool.

Significantly, PeckShield added:

By exploiting the public mint bug, the actor can burn most SFM tokens in the pair, which increases the SFM price. With that, the actor basically buys SFM at the beginning, next exploits the public mint bug to increase the SFM price, and then sells SFM with a profit [greater than] $8.9 million.

Nonetheless, the hackers declared after some hours that they are willing to return the fund, following which it was reported that the attackers have already sent 4000 BNB equivalent to $1.2 million.

Source