Leaderboard
967All-time rank
SS
SNK (Snooker)
May 10, 2023
$198K
Lost
$198K
Recovered
$0
Net loss
$198K
Unrecovered0% recovered
The SNK token on BSC suffered an exploit of its referral reward mechanism. The attacker exploited the bindParent function of the SNKMiner contract to establish relationships between attack contracts, amplifying staking rewards based on child account SNK balances.
By creating multiple attack contracts and establishing referral chains, the attacker was able to claim inflated rewards totaling approximately $197,725.
How the exploit worked
View reproducible PoCReward Calculation Error.
Lost: ~$197k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Binance Smart Chain
Event timeline
- May 10, 2023Exploit executed — $198K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)
