Gala Games said that it has filed a lawsuit against pNetwork the cross-chain interoperability bridge that Gala uses on the BNB Smart Chain.
Gala Games was hacked in November of last year after over $2 billion in GALA tokens were created by an unauthorized wallet address and dumped on PancakeSwap, removing $4.5 million from the liquidity pool and sharply depressing the price of GALA tokens.
According to the lawsuit, pNetwork’s “negligence and tortious interference” were to blame for the occurrence. On November 7, 2022, the blockchain analytics platform SlowMist said that the problem might have been caused by a plain text private key breach in one of three Gala-based smart contracts connected to the pNetwork.
According to SlowMist, the compromised private key was accessible to everyone on GitHub.
“The lawsuit states that (i) pNetwork admitted that it mistakenly leaked a governance key when deploying this pGALA bridge, which such key was later used by an attacker to breach the pGALA contract on the BNB chain, […]”
A pNetwork official said the following in a statement:
“As the pNetwork team, we would like to express our genuine surprise and concern upon hearing the recent announcement by the GALA Games Project to sue pNetwork. We would like to clarify that, three months ago, we had already submitted a comprehensive report to the Swiss authorities detailing the entire incident.”
The representative claimed that full conversations and pertinent evidence were included in the report and claimed that the Gala Games team deleted texts as part of “their role in planning, supporting, and communicating the so-called white hat intervention.” pNetwork said once more:
“We have been fully transparent and cooperative with the authorities in this matter, and we firmly believe that the truth will come to light.”
pNetwork asserted that its participation in the exploit was a “white hat move” shortly after the incident. Huobi Global, a bitcoin exchange, has disputed the claim.
In addition to $27.7 million in “out-of-pocket costs related to the breach, further compensation for injuries, punitive damages and other relief,” Gala Games claims the alleged breach resulted in over $25 million in damages.
“In the event that the suit succeeds, Gala has stated that any damages, less legal fees, will be converted to $GALA and burned. Gala is also aware of the damage that pNetwork’s actions caused many other third-parties, and invites these other injured parties to contact the legal team”
In a post-mortem analysis dated on Nov. 5, 2022, pNetwork stated that a “misconfiguration of the pNetwork-powered bridge for the GALA token” was noticed by the developer team and that “the ownership of the pGALA smart contract (deployed on BSC) had been covertly taken over due to the misconfiguration:
“Lack of control over the token smart contract gives the attacker the ability to create new tokens and change pGALA at will”. Moreover, pNework wrote:
“No hack was actually performed by whomever currently retains ownership of that smart contract (from now on, the “attacker”), but the situation highlighted a high security risk that had to be promptly mitigated”
Gala also claimed that on November 5, 2022, pNetwork created a plan to fully refund “the BNB assets gathered through the whitehat draining of the pool,” but in a follow-up on November 11, 2022, it is claimed that the plan was abandoned.
The second half of pNetwork’s recovery plan, including BNB tokens, “is still on hold,” it was stated in a Telegram thread, while the first part, involving GALA tokens, “has been completed.”
On February 8th, we had our initial meeting with the Swiss authorities (“Ministero Pubblico” of Lugano, Switzerland) to talk about the incident. Although the conversation is still going on, we anticipate making some headway in the upcoming weeks.
In a court of law, none of the charges have been proven true. To address this matter in the best interests of all parties involved, pNetwork indicated that it “will continue to cooperate closely with the Swiss authorities and offer any additional information as needed.”
