Double-Spending Bug Leads to $4.8M Withdrawal, Massive Drop in Super Sushi Samurai Value
Summary:
Super Sushi Samurai (SSS), a GameFi project, witnessed a $4.8 million withdrawal after an individual exploited a double-spending bug. The individual who made use of the loophole referred to himself as a "white hat" hacker, intending to help the team identify the issue. However, this action contributed to a steep decline in SSS's total market cap, with the tokens losing over 99% of their value. This event follows a similar incident with the ERC-X token Miner, which led to losses exceeding $10 million due to a comparable glitch.
Super Sushi Samurai (SSS), a GameFi project founded on Coinbase's Layer-2 blockchain and Telegram, experienced a $4.8 million exodus from its reserves on March 21. This came after a self-styled "white hat" hacker discovered and exploited a double-spending flaw. Blockchain analysis company CertiK revealed to Cointelegraph that there was a flaw in the SSS contracts _update() function that doesn't properly adjust balances when transferring to oneself. Hence when a user transfers their entire SSS token stash to themselves, the balance doubles.
The hole allowed an individual using the address 0x786C8f95C17BB990a040dc4D6539B01FC1b72842 to purchase 690 million SSS tokens. They then transferred the entire stack to themselves, doubled it 25 times, and ended up with 11.5 trillion SSS tokens. These were then liquidated for 1,310 ETH equating to approximately $4,590,827.
Following the event, the individual responsible affirmed via a blockchain note that his actions were the results of a "whitehat rescue hack", suggesting that he was helping the team identify the loophole. However, it should be noted his actions caused a significant downturn in the SSS token market, forcing a $4.8 million withdrawal which contributed to a dramatic drop in SSS's total market cap, from $27.75 million. Since then, the tokens have dramatically lost over 99% of their value.
In response to the withdrawal, SSS's developers reached out to the person, thanking them for their cooperation. This incident follows a similar one, where Miner, a novel ERC-X token, plummeted 99% after a double-spending glitch that resulted in limitless token creation was found. The bug resulted in a loss exceeding $10 million, leading Yu Xian, co-founder of SlowMistto a blockchain security firm, to comment on the low-level contract defects, allowing balance duplication via self-transfers.
Published At
3/21/2024 9:50:53 PM
Disclaimer: Algoine does not endorse any content or product on this page. Readers should conduct their own research before taking any actions related to the asset, company, or any information in this article and assume full responsibility for their decisions. This article should not be considered as investment advice. Our news is prepared with AI support.
Do you suspect this content may be misleading, incomplete, or inappropriate in any way, requiring modification or removal?
We appreciate your report.