Leaderboard
701All-time rank
Chainge Finance
Apr 15, 2024
$716K
Lost
$716K
Recovered
$0
Net loss
$716K
Unrecovered0% recovered
On April 15, 2024, ChaingeFinance on BSC was exploited via arbitrary external call in the swap function. Both the target contract and callData parameters were controllable, allowing attackers to execute unauthorized transferFrom calls on victim accounts, draining all approved tokens.
How the exploit worked
View reproducible PoCArbitrary External Call.
Lost: ~560K
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Apr 15, 2024Exploit executed — $716K drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)