GoPlus Security 🚦 (@GoPlusSecurity): 🧵1/5

🧵1/5 ⚠️ Vulnerability Analysis: Analysis of the attack on @CryptoDAOGlobal On July 28, the $Pro token of @CryptoDAOGlobal on #BNBChain was exploited due to an access control vulnerability. The attacker profited approximately $52K, while the exploited contract lost 167,200 $Pro. All of these $Pro tokens were swapped into $USDT and transferred to the receivers in the exploited contract. The attacker repeatedly called the exec function of the exploited contract 0xc44f2a within a single transaction. Each call swapped 50 $Pro into $USDT. After multiple executions, the attacker significantly increased the price of the Pro/USDT trading pair, and finally swapped the $Pro holdings into $USDT to realize the profit. The root cause was that the exec function in the exploited contract lacked access control and could be called by any contract.