Huo Xing Finance reports, according to SlowMist monitoring, the ONTR token contract suffered an access control vulnerability due to the onlyOwner modifier, resulting in a loss of 49.4801 WETH, valued at approximately $98,000. The attacker (0xe806...b760) exploited this vulnerability by bypassing the permission check when the owner was address(0), calling transferOwnership() to set their own contract as owner, then invoking desertJasper() to add the hidden balance to the queue, followed by glenFlash() to execute ashBud(), directly increasing the address balance by 1e30 base units without increasing totalSupply. The attacker transferred the inflated tokens to PancakePair (0xd46d...83fd) and swapped them for WETH via swap().
ONTR Token Contract Vulnerability Results in $98,000 Loss
MarsBitShare
Summary
A smart contract vulnerability in the ONTR token exposed a critical security flaw, enabling an attacker to exploit the onlyOwner modifier. SlowMist reported that the owner was set to address(0), allowing the attacker to bypass permissions, call transferOwnership(), and manipulate balances. The attacker inflated their token balance by 1e30 units, transferred the tokens to PancakePair, and swapped them for 49.4801 WETH, totaling approximately $98,000. The incident underscores the importance of rigorous smart contract audits and enhanced security practices.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.