Leaderboard
782All-time rank
B
BNO
Jul 18, 2023
$500K
Lost
$500K
Recovered
$0
Net loss
$500K
Unrecovered0% recovered
BNO's emergencyWithdraw function on BNB Chain lacked access controls and didn't check for NFT rights records. An attacker exploited this to deposit both NFT and ERC20 tokens, then withdraw only the ERC20 via emergencyWithdraw, bypassing reward calculations and earning undeserved mining rewards.
How the exploit worked
View reproducible PoCInvalid emergency withdraw mechanism.
Lost: ~$505K
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
BNB Chain
Event timeline
- Jul 18, 2023Exploit executed — $500K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)