Lỗ hổng hợp đồng token ONTR dẫn đến tổn thất 98.000 USD

The Huoxing Finance report, according to SlowMist monitoring, the ONTR token contract suffered an access control vulnerability due to the onlyOwner modifier, resulting in a loss of 49.4801 WETH, valued at approximately $98,000. The attacker (0xe806...b760) exploited this vulnerability by passing the permission check when owner was address(0), calling transferOwnership() to set the attacker’s contract as owner, then calling desertJasper() to add the hidden balance to the queue, followed by glenFlash() to execute ashBud(), directly increasing the address balance by 1e30 base units without increasing totalSupply. The attacker transferred the inflated tokens to PancakePair (0xd46d...83fd) and swapped them for WETH via swap().