Garden Finance, Moonwell, DMi Token: $11.9M Lost to Private Keys, Price Oracles, and Token Transfer Bugs

In Brief

• DMi Token lost $124K due to a transfer function error.
• Moonwell lost $1M after a faulty oracle priced wrsETH at $5.8M.
• Garden Finance lost $10.8M due to compromised private keys.

Hacks Analysis

DMi Token | Amount Lost: $124K

On December 8th, the DMi Token exploit on the BNB chain resulted in a $124K loss. The root cause of the exploit was a logic error in the transfer() function. When DMi tokens were sent to the PancakeSwap pair contract, the function redirected the entire amount to a fee address (outfee_add) instead of delivering them to the pair. This caused the pair's actual token balance to desynchronize from its internal reserves used for pricing. This allowed the attacker to reduce the token reserves and artificially inflate the price to make a profit.

Exploited Contract (BSC): 0xd88c707e32651ba7e9a08446ab0fcfb962934cf8

Transaction: 0x2330a8cf71d301a0f5c2f617f6e0a4c3ec5005ac1953fbccbb72f905113b9b6a

Moonwell | Amount Lost: $1M

On November 4th, the Moonwell exploit on Base network resulted in a $1M loss due to a faulty price oracle. The root cause of the exploit was that Moonwell used a low-liquidity, delisted Chainlink price oracle for wrsETH that reported secondary market prices instead of the canonical exchange rate. The oracle incorrectly priced wrsETH at $5.8M (instead of ~$3,100). This allowed the attacker to borrow assets against overvalued collateral and drain funds.

Transaction (Base): 0x190a491c0ef095d5447d6d813dc8e2ec11a5710e189771c24527393a2beb05ac

Garden | Amount Lost: $10.8M

On October 31st, the Garden Finance exploit on multiple chains resulted in a $10.8M. The root cause of the exploit was a private key compromise of the contract that managed bridge funds. The attacker transferred 501 BNB and 1,910 ETH to Tornado Cash. The Garden Finance acknowledged the incident and offered a 10% whitehat bounty for fund return.

Exploited Contract: 0x3fDEe07b0756651152BF11c8D170D72d7eBbEc49

Transaction: 0x71907833b95cbd129a3c18e9f73bfe33cdd37767b8c7ea373450fdb78a6f3433

Olympix: Your Partner in Secure Smart Contracts

Olympix provides advanced Solidity analysis tools to help developers identify and fix vulnerabilities before they become critical exploits.

Get started today to fortify your smart contracts and proactively shield them from exploits in the evolving Web3 security landscape.

Connect with us on:

Twitter | LinkedIn | Discord | Medium | Instagram | Telegram | Newsletter