📢 Gate Square #MBG Posting Challenge# is Live— Post for MBG Rewards!
Want a share of 1,000 MBG? Get involved now—show your insights and real participation to become an MBG promoter!
💰 20 top posts will each win 50 MBG!
How to Participate:
1️⃣ Research the MBG project
Share your in-depth views on MBG’s fundamentals, community governance, development goals, and tokenomics, etc.
2️⃣ Join and share your real experience
Take part in MBG activities (CandyDrop, Launchpool, or spot trading), and post your screenshots, earnings, or step-by-step tutorials. Content can include profits, beginner-friendl
Poolz platform was attacked by hackers, $665,000 worth of tokens were stolen.
Poolz platform was attacked, resulting in a loss of approximately $665,000.
On March 15th, the Poolz platform on Ethereum, Binance Smart Chain, and Polygon networks was attacked by hackers in the early morning. According to data platform monitoring, this attack resulted in the theft of various tokens, including MEE, ESNC, DON, ASW, KMON, and POOLZ, with a total value of approximately $665,000.
The attacker exploited an arithmetic overflow vulnerability in the Poolz platform's smart contract. Specifically, the issue lies in the getArraySum function within the CreateMassPools function. This function does not properly handle the overflow situation that may occur when adding large numbers while calculating the initial liquidity for users creating pools in bulk.
The attack process is as follows:
The attacker first exchanged some MNZ tokens at a certain decentralized exchange.
Subsequently, the CreateMassPools function was called with carefully crafted parameters, causing the getArraySum function to return an overflow value. This resulted in the recorded liquidity amount in the system being far greater than the actual number of tokens transferred in.
Finally, the attacker extracted tokens far exceeding the actual amount deposited through the withdraw function, completing the attack.
This incident once again highlights the importance of correctly handling integer operations in smart contract development. To prevent similar issues, developers should consider using a newer version of the Solidity compiler, which has a built-in overflow check mechanism. For projects using earlier versions of Solidity, third-party security libraries can be adopted to mitigate the risk of integer overflow.
Currently, the stolen funds have not been fully transferred, and some have been exchanged for BNB. Relevant parties are conducting further investigations and tracking. This incident reminds DeFi project teams to pay more attention to the security of smart contracts, conduct regular code audits, and take necessary security measures to protect user assets.