- Type: Exploit
- Network: Ethereum
- Total lost: 30,437 OHM ~= 300K USD (returned later)
- Category: Data validation
- Exploited contracts:
- Attack transactions:
- Attacker Addresses:
- Attack Block:: 15794364
- Date: Oct 21, 2022
- Reproduce:
forge test --match-contract Exploit_OlympusDAO -vvv
- Craft and deploy a contract so that it passes the requirements.
- Call
redeemwith the malicious contract as thetoken_
The attack relies on an arbitrarily supplied token_ parameter. The attacker simply needs to construct a malicious contract as the token_. Most importantly, it should return a token that has been permitted by the victim contract to move funds when its _underlying() method is called.
function redeem(ERC20BondToken token_, uint256 amount_)
external
override
nonReentrant {
if (uint48(block.timestamp) < token_.expiry())
revert Teller_TokenNotMatured(token_.expiry());
token_.burn(msg.sender, amount_);
token_.underlying().transfer(msg.sender, amount_);
}The attacker chose to set _underlying() to the OHM address.
Luckily for the DAO, the attacker was a whitehack that later returned the funds.
- Implement a whitelist of allowed tokens.
