Leaderboard
975All-time rank
T
TIME
Dec 6, 2023
$190K
Lost
$190K
Recovered
$0
Net loss
$190K
Unrecovered0% recovered
TIME token's integration of ERC-2771 with an unprotected multicall mechanism allowed arbitrary address spoofing. An attacker executed a delegatecall with malicious data, burned massive amounts of tokens from the LP, inflating the token price to extract ~$190K.
How the exploit worked
View reproducible PoCArbitrary Address Spoofing Attack.
Lost: ~84.59 ETH
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Input Validation
- Technique
- Missing Input Validation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Dec 6, 2023Exploit executed — $190K drained via missing input validation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)
