Cointime

Cointime

Download App
iOS & Android

SharkTeam: Analysis of the HashFlow Attack Incident

On June 14, 2023, Beijing time, HashFlow fell victim to a hacker attack, resulting in an estimated profit of around $600,000 for the attackers.

SharkTeam conducted a prompt technical analysis of the incident and has summarized security measures to be taken as a precautionary approach. It is our hope that this incident serves as a lesson for future projects, contributing to the strengthening of security defenses within the blockchain industry.

1. Incident analysis

Attacker address: 0xBDf38B7475Ff810325AA39e988fb80E0aA007E84

Attack contract: 0xDDb19a1Bd22C53dac894EE4E2FBfdB0A06769216

Attacked contract: 0x79cdFd7Bc46D577b95ed92bcdc8abAba1844Af0c

Attack transactions:

0xdedda493272b6b35660b9cc9070d2ea32ee61279b821184ff837e0a5752f4042

0xb08f6d3fc70b95223cfffc2c905d9c0467a589e5f652cd193e5c00b4ad329b99

0x08b5f35076beb363a7206b8f9b4a6460f42aa9f998b561582fb4e4cdd6f05dce

1. After deploying the attack contract (0xDDb19a1B), the attacker (0xBDf38B74) proceeded to call the Wooooo function within the attack contract (0xDDb19a1B).

2. The attack contract (0xDDb19a1B) called the function 0x0031b016 of the target contract (0x79cdFd7B) during the attack.

3. The function directly transferred the user's USDT tokens to the attack contract.

2. Vulnerability Analysis

The target contract (0x79cdFd7B) that was attacked is a deprecated HashFlow contract, which was abandoned in May of the previous year and was not open-source. Through reverse engineering, it can be observed that the contract transfers tokens from the "from" address to the "to" address. Based on analysis, it is highly likely that users had granted significant authorization to this contract before May of the previous year. However, after the contract was deprecated, these authorizations were not revoked, and due to potential issues with the restriction logic after deprecation, attackers were able to call functions in the deprecated contract to transfer user assets.

3. Subsequent Developments

After carrying out the attack, the attacker (0xBDf38B74) open-sourced the attack contract and left a message stating, "Before use recover, please revoke first. Your funds are not safe." This message serves as a reminder to users to revoke their authorizations to the targeted contract (0x79cdFd7B) before transferring their funds elsewhere.

The hacker left behind two functions. One function allows users to withdraw all their funds, while the other function leaves 10% of the assets as a reward for the attacker. Currently, users have started withdrawing their funds one by one.

4. Security Recommendations

The occurrence of this incident was due to the fact that the targeted contract (0x79cdFd7B) had received significant user authorizations in the past, and these authorizations were not revoked after its deprecation, resulting in user asset losses. To prevent similar attacks in the future, it is important to follow these precautions during the development process:

(1) Project developers should thoroughly validate and address any potential logic issues that may arise after deprecating a contract.

(2) Users should regularly review their account authorizations for different protocol contracts and promptly revoke authorizations for contracts they no longer interact with or have been upgraded.

(3) Before deploying contract upgrades, it is crucial to collaborate with professional third-party auditing teams to ensure security.

About us

SharkTeam’s vision is to comprehensively protect the security of the Web3 world. The team is composed of experienced security professionals and senior researchers from all over the world. They are proficient in the underlying theory of blockchain and smart contracts, and provide services including smart contract auditing, on-chain analysis, and emergency response. It has established long-term cooperative relationships with key players in various fields of the blockchain ecosystem, such as Polkadot, Moonbeam, polygon, OKC, Huobi Global, imToken, ChainIDE, etc.
Official website: https://www.sharkteam.org/
Twitter: https://twitter.com/sharkteamorg
Discord: https://discord.gg/jGH9xXCjDZ
Telegram: https://t.me/sharkteamorg

Web3 SharkTeam
Comments

All Comments

Recommended for you

  • Amazon Shares Surge 15.2%, Biggest Gain Since 2012

    On July 31, Amazon shares surged 15.2% to $271.255 per share, marking their biggest gain since 2012, with a total market value of $2.92 trillion.

  • US Treasury Secretary Bessent Vows to Track Down Iranian Assets Globally for Terror Victims

    US Treasury Secretary Bessent said the US will actively track down Iranian assets worldwide to ensure compensation funds for victims of Iran-backed terrorist activities. Bessent stated that the US government's military and economic blockade measures against the Iranian regime will continue and will not be relaxed. (Jinshi)

  • Apple Plunges Nearly 10%, Q4 Revenue Guidance Misses Expectations

    On July 31, Apple (AAPL.US) plunged nearly 10% to $300.33, marking its biggest drop since April 2025. In terms of fundamentals, Apple's third-fiscal-quarter revenue rose approximately 16% year-over-year to $109.42 billion, slightly above analyst expectations. Among the details, product revenue came in at $78.68 billion, beating the expected $77.25 billion. However, services revenue—a key driver of its valuation re-rating in recent years—totaled $30.74 billion, missing the consensus estimate of $31.36 billion. Additionally, Greater China revenue reached $18.82 billion, with year-over-year growth slowing to 22%, also below analysts' forecast of $19.58 billion. During the earnings call, Apple guided fourth-fiscal-quarter revenue growth in the range of 9% to 11%, overall below the 12.1% analysts had expected. CFO Parekh noted that component supply constraints would impact iPhone, Mac, and iPad businesses in the fourth fiscal quarter, with currency fluctuations also constraining growth.

  • Three Fed Officials Back Rate Hike, Hawkish Pressure Builds

    On July 31, three Federal Reserve policymakers said that dissenting votes in favor of a rate hike this week stemmed from stubborn inflationary pressures, highlighting rising internal pressure on Fed Chair Warsh to act. In statements released Friday morning, Hammack and Kashkari said they worry that although the current round of price increases may stem from short-term factors such as President Trump's tariff policies and the Iran war, the inflation situation already warrants Fed action. Logan also joined in, saying that even if inflation cools, if the Fed does not raise rates, inflation is unlikely to fully fall back to the Fed's 2% target; without any policy constraints, inflation could continue to run above target until an unexpected shock occurs. Kashkari said that if inflation remains persistently stubborn, he might support a series of rate hikes, not just a single increase, to prevent inflation from becoming further entrenched. He said: "A series of small policy adjustments may be preferable to waiting for developments to unfold and ultimately having to take more forceful action." Hammack said that if the Fed does not tighten policy, price increases could continue to accelerate. She said: "Inflation has been stubbornly above 2% for more than five years, and I have no confidence that it will return to our target on its own." (Jin Shi)

  • US 10-Year Treasury Yield Rises to 4.7388%, Highest Since January 2025

    On July 31, the US 10-year Treasury yield rose to 4.7388%, the highest level since January 2025.

  • Spot Gold Intraday Decline Widens to 2%, at $4,021.08 per Ounce

    On July 31, spot gold's intraday decline widened to 2%, reported at $4,021.08 per ounce.

  • BTC Falls Below $63,000

    Market数据显示，BTC has fallen below $63,000, currently reported at $62,985.99, with a 24-hour decline of 2.99%. Market volatility is significant, please exercise risk control.

  • Fed's Logan: Leaning Toward 25 Basis Point Rate Hike

    On July 31, Federal Reserve Governor Logan said she leans toward a 25 basis point rate hike, believing inflation has not yet entered a sustainable path back to the Fed's 2% target. Logan stated that taking moderate action now would reduce the risk of needing more aggressive tightening in the future, while emphasizing that the Fed cannot rely on unexpected shocks to achieve its inflation target.

  • Fed's Logan: Taking Modest Actions Now Reduces Likelihood of Needing Stronger Action Later

    On July 31, Dallas Fed President Lorie Logan said that taking modest actions in the near term would reduce the likelihood of needing to take stronger action in the future.

  • Web3 data and AI company Validation Cloud completes $10 million in new round of financing

     Web3 data and AI company Validation Cloud announced a $10 million financing round from True Global Ventures. The company plans to use the funds to expand its AI products and achieve seamless access to Web3 data.

Daily Must-Read

Popular Activities

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

RaveDAO at Terra Solis by Tomorrowland: A Female-Led Techno Night Where Web3 Culture Converges

April 30 - April 30
Dubai

Popular Tags

Cointime
News
Contents
RSS
Company