Leaderboard
967All-time rank
SS

SNK (Snooker)

May 10, 2023

$198K
Lost
$198K
Recovered
$0
Net loss
$198K
Unrecovered0% recovered

The SNK token on BSC suffered an exploit of its referral reward mechanism. The attacker exploited the bindParent function of the SNKMiner contract to establish relationships between attack contracts, amplifying staking rewards based on child account SNK balances.

By creating multiple attack contracts and establishing referral chains, the attacker was able to claim inflated rewards totaling approximately $197,725.

How the exploit worked

View reproducible PoC

Reward Calculation Error.

Lost: ~$197k

Source: DeFiHackLabs (SunWeb3Sec)

Target
DeFi
Classification
Access Control
Technique
Improper Access Control
Attribution
Unknown
Chains
Binance Smart Chain

Event timeline

  1. May 10, 2023
    Exploit executed — $198K drained via improper access control
  2. Attributed to Unknown
  3. Recovery status Unrecovered 0%

Data credits

Related incidents