Hack Overview
In a shocking turn of events, the multichain exchange aggregator, Dexible, fell victim to a crippling exploit that resulted in the loss of over $2 million in cryptocurrency. According to a comprehensive report released by the team on February 17, the breach has sent ripples of concern throughout the crypto community.
The Discovery Process
It all started early in the morning when one of Dexible’s founders noticed an unauthorized $50,000 transfer from their wallet. Alarm bells rang, and by 6:17 AM UTC, the team alerted users about a potential hack on its v2 contracts. As investigations progressed, it turned out that around $2,047,635.17 had been drained from 17 trader addresses—four on the mainnet and thirteen on Arbitrum.
The SelfSwap Function: A Double-Edged Sword
The culprit behind this digital heist was the app’s selfSwap function, which allows users to trade tokens by providing a router address and the associated calldata. Unfortunately, the code lacked a necessary fail-safe: a list of preapproved routers. This oversight allowed the hacker to exploit the selfSwap function, rerouting tokens from unsuspecting user wallets into a smart contract controlled by the hacker.
- **Attack Method**: The attacker utilized the authority given to Dexible by the users to execute transactions that should have been safe.
- **Outcome**: The stolen tokens were quickly funneled into the hacker’s smart contract and subsequently laundered through Tornado Cash, vanishing into the depths of the blockchain.
The Response from Dexible
By 4:00 PM UTC, a post-mortem report had been shared via PDF on Discord, detailing the incident and laying out the planned remediation efforts. Dexible has since paused its contracts and urged users to revoke any token authorizations for its platform until further notice, highlighting the importance of user vigilance in a market fraught with potential pitfalls.
Lessons Learned: Stay Woke, Crypto Users!
Experts have sounded the alarm over the dangers of granting blanket token approvals, especially when utilizing platforms that may not have robust security measures. Many crypto users remain oblivious to the risks of approving extensive token access, often resulting in significant financial losses during hacks or exploitations.
- Regularly revoke token authorizations.
- Stay informed about security flaws in your apps.
- If possible, limit token approvals to lower amounts.
