Leaderboard
606All-time rank
BasketDAO
Mar 30, 2022
$1.2M
Lost
$1.2M
Recovered
$0
Net loss
$1.2M
Unrecovered0% recovered
BasketDAO's BMIZapper contract lacked input validation in the _primitiveToBMI function, allowing arbitrary external calls. The attacker passed a malicious address to drain all approved crypto assets held by the contract.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Mar 30, 2022Exploit executed — $1.2M drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%