{"id":92891,"date":"2024-09-11T10:26:24","date_gmt":"2024-09-11T14:26:24","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=92891"},"modified":"2024-09-11T10:26:30","modified_gmt":"2024-09-11T14:26:30","slug":"unverified-contract-drains-1-4m-from-cut-token","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/unverified-contract-drains-1-4m-from-cut-token\/","title":{"rendered":"Unverified Contract Account Drains $1.4M from CUT Token Pools"},"content":{"rendered":"\n

On September 10, blockchain security platform Certik reported an attacker drained over $1.4M worth of Bows Coin Synthetic US Dollar <\/a>(BSC-USD) from a liquidity pool that held CUT tokens <\/p>\n\n\n\n

\"Unverified
Unverified Contract Account Drains $1.4M from CUT Token Pools<\/figcaption><\/figure>\n\n\n\n

The CUT token contract depended on a distinct, unverified contract to establish its “future yield” parameter. This contract was utilized to drain the BSC-USD using an unknown method.<\/p>\n\n\n\n

CertiK reported the event on X.<\/p>\n\n\n\n

\n

#CertiKInsight\r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a> \ud83d\udea8

We have seen a flashloan exploit involving CUT token

BSC: 0x7057F3b0F4D0649B428F0D8378A8a0E7D21d36a7

The CUT contract uses ILPFutureYieldContract(_lpFutureYieldContractAddress) at 0x0917914b0A70ee7F1f2460Fcd487696856E31154 which is unverified and contains\u2026 pic.twitter.com\/ycE4Px3Nxy<\/use><\/svg><\/span><\/a><\/p>— CertiK Alert (@CertiKAlert) September 10, 2024<\/use><\/svg><\/span><\/a><\/blockquote>

Located at an address ending in 36a7 on the Binance Smart Chain, the CUT token that was exploited is distinct from the Crypto Unity project, which shares the same ticker symbol but a different address. <\/p>\n\n\n\n

Drainage of the pool was a component of the Pancakeswap exchange<\/use><\/svg><\/span><\/a>. It is not believed to have impacted any other Pancakeswap pools.<\/p>\n\n\n\n

According to blockchain data, the perpetrator conducted four distinct transactions that drained the BSC-USD pool. The total quantity that was removed was $1,448,974.<\/p>\n\n\n\n

\"CUT
CUT exploit transactions. Source: BSCScan.<\/em><\/figcaption><\/figure>\n\n\n\n

The transaction is unlikely to be a legitimate withdrawal, as the perpetrator did not own any liquidity provider tokens for the pool and had not made any deposits.<\/p>\n\n\n\n

Within each transaction, the perpetrator invoked a function known as “0x7a50b2b8.” However, it is absent from the token contract.<\/p>\n\n\n\n

According to the report, the attacker must have invoked ILPFutureYieldContract(), which enables the user to call a distinct function on an entirely different contract whose address terminates in 1154. The BSC Scan does not display any readable bytecode for this particular contract, as it is unverified.<\/p>\n\n\n\n

\"Separate
Separate contract used in CUT exploit. Source: BSCSCan.<\/em><\/figcaption><\/figure>\n\n\n\n

Cointelegraph could not locate any marketing website or Twitter account promoting CUT. Investors may have mistakenly named it the unrelated Crypto Unity project.<\/p>\n\n\n\n

Exploits are a prevalent method for Web3 users to incur losses. An exploit of the Penpie decentralized finance protocol<\/a> resulted in the loss of more than $25 million in cryptocurrency on September 3.<\/p>\n\n\n\n

An attacker exploited a defective deployment script to siphon $10 million from the Ronin gaming network's bridge on August 6. In this instance, the exploit has resulted in a collective loss of $1.4 million for CUT liquidity providers.<\/p>\n","protected":false},"excerpt":{"rendered":"

On September 10, blockchain security platform Certik reported an attacker drained over $1.4M worth of Bows Coin Synthetic US Dollar (BSC-USD) from a liquidity pool that held CUT tokens The CUT token contract depended on a distinct, unverified contract to establish its “future yield” parameter. This contract was utilized to drain the BSC-USD using an […]<\/p>\n","protected":false},"author":12,"featured_media":84455,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[21770,21769,10413],"class_list":["post-92891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-crypto-unity-project","tag-cut-token","tag-pancakeswap-2"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/07\/rho-markets.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/92891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=92891"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/92891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/84455"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=92891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=92891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=92891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}