Security Team: The EtnProduct project suffered a flash loan attack

[Security Team: EtnProduct Project Suffered Flash Loan Attack] On August 5, information from members of the Chengdu Lianan community showed that the EtnProduct project was attacked by flash loan. The security team of Chengdu LianAn analyzed and found that: the attacker first borrowed 9,400 USDT using flash loans, and then the attacker purchased an NFT and linked the NFT to the EtnProduct project. Due to the fixed number of liquidity tokens added when placing an order, and the The token was sent to the caller, and the attacker then destroyed the token to set out 606,091.527 U tokens in the liquidity, and called the saleU function of the UMarket project to convert 11,253.735 U tokens into USDT one by one and return the flash loan. A total of about US$3,074 in profit and an NFT worth US$7,380 have been made. Currently, the profits are still deposited in the attacker’s address (0xde703797fe9219b0485fb31eda627aa182b1601e). In the future, Chengdu Lian'an's on-chain fund tracking platform "Chain Bizhui" will continue to monitor and track this address.

Other news:

Security Team: The Shonen Junk project Discord server has been hacked: Jinse Finance News, the security team CertiK said that the Shonen Junk project Discord server has been hacked. Chat is currently locked. Community users please do not click, mint or approve any transactions. [2022/9/27 22:33:03]

Security Team: It is suspected that there was a change in the stolen funds of BXH on September 21, and 1865 ETH was transferred to Tornado Cash: Golden Finance News, according to the security team of SlowMist, according to the announcement of the BXH Stupid Kids Team on September 23, the day before yesterday (September 21) ) in total worth $2.5 million worth of assets and 38 million BXH tokens were stolen late.

SlowMist MistTrack analyzed and evaluated that the private key of the original owner of the BXH VaultPool contract was suspected to be stolen, and the inCaseTokensGetStuck function was called to transfer the funds in the contract to the hacker’s address, which was 0x158f...e345.

So far, the hacker has exchanged the stolen funds across the chain to the ETH chain, and further transferred all the stolen funds to Tornado Cash, with a total transfer amount of 1865 ETH. SlowMist MistTrack will continue to follow up on the transfer of stolen funds. [2022/9/24 7:18:31]

Security Team: The Discord server of the Arcade project has been hacked: Golden Finance News, the security team CertiK said that the Discord server of the Arcade project has been hacked. Community users please do not click, mint or approve any transactions. [2022/9/19 7:05:03]