MRP token exploit analysis
On July 2, 2024, the MRP token on BSC experienced an exploit. The WMRP wrapped-token contract was attacked via a reentrancy vulnerability, resulting in a loss of approximately 17 BNB. Let's examine the details of how this attack took place.
Overview
Attacker address:
https://bscscan.com/address/0x132d9bbdbe718365af6cc9e43bac109a9a53b138
Attack transaction: https://bscscan.com/tx/0x4353a6d37e95a0844f511f0ea9300ef3081130b24f0cf7a4bd1cae26ec393101
Vulnerable contract (WMRP): https://bscscan.com/address/0x35f5cef517317694df8c50c894080caa8c92af7d
Exploit analysis
From the attack transaction, we can see a flaw in which the WMRP contract triggered the attacker's fallback
function while removing the liquidity (WMRP.BurnLP
).
Check out the source code of the transfer
function. The flow that allows the attacker to trigger the reentrancy attack seems to be in the _removeLiquidity
function. In order to trigger this branch, the attacker needs to transfer the WMRP token to itself with a value of 0
.
While hooking into the transfer
function, the attacker could re-enter the receive
function by transferring BNB back to the WMRP contract.
Through manipulation of the transfer
function, the attacker managed to obtain more MPR tokens than allowed and drained all the BNB from the contract.
Conclusion
By sharing our insights on these vulnerabilities, we aim to help the web3 community identify and mitigate similar attack vectors in future projects, thereby enhancing the security and robustness of the DeFi ecosystem.