Leaderboard
1195All-time rank
RO
Ragnarok Online Invasion
Sep 8, 2022
$44K
Lost
$44K
Recovered
$0
Net loss
$44K
Unrecovered0% recovered
Ragnarok Online Invasion's ROI token contract on BSC was exploited on September 8, 2022 when an attacker called the unprotected transferOwnership function. Despite the contract having an onlyOwner modifier, it was not applied to the ownership transfer function, allowing unauthorized ownership changes and theft of ~158 BNB.
How the exploit worked
View reproducible PoCBroken Access Control.
Lost: 157.98 BNB (~44,000 US$)
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- Other
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Sep 8, 2022Exploit executed — $44K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)