Analysis of Titano Finance Attack Event

foreword

On the evening of February 14, 2022, Beijing time, Titano Finance was attacked and lost 32 million TITANO tokens. Knowing that Chuangyu Blockchain Security Lab tracked and analyzed this incident for the first time.

analyze

analyze

fundamental analysis

Attacker address: 0xad9217e427ed9df8a89e582601a8614fd4f74563

Attacker creates contract MultipleWinnersProxyFactory: 0x940151f5bbbcda5b1b482592d816e96f80d6073a

Attacker creates contract MultipleWinnersBuilder: 0x1866207c355d4c6e0b03b4dc0bf9c658f4d13f8a

Official contract StakePrizePool: 0x4d7f0a96967dce1e36dd2fbb131625bbd9106442

Vulnerability analysis

Vulnerability analysis

In this incident, the key to the vulnerability lies in the fact that the setPrizeStrategy method in the official StakePrizePool contract was exploited by the attacker, but only administrators have permission to operate this method.

Then the attacker sets the _prizeStrategy address in the contract to the address of the contract MultipleWinners created by the attacker

After the attacker obtains the token, he converts the token, and finally converts it into BNB through PancakeSwap, and then distributes the funds to various addresses

Summarize

Summarize

The core reason for this attack is that the administrator-only call method in the official StakePrizePool contract was maliciously used. The cause may be the leakage of the project party’s management address, or it may be the person who has the administrator’s private key stealing it.