Hacker siphons $2.3m from TempleDAO

On October 11, an unknown individual exploited a vulnerability in the DeFi project TempleDAO’s smart contract and stole 1,831 ETH (about $2.3 million) from one of the staking vaults. The team pledged to return the funds to the users affected by the attack.

🚨 Temple DAO’s https://t.co/kQK1dEfpkQ was exploited 1 hour ago for a total value of $2.3m (1,831 ETH).

We have reached out to the team to assist and have contacted Binance which the wallet was funded by.

Funds are presently on-chain in eth.https://t.co/jyeEUYyUw1

— Paladin Blockchain Security (@0xPaladinSec) October 11, 2022

In a series of transactions, the attacker moved a total of 321,154 xLP tokens, swapping them for 1,262,438 FRAX and 1,418,303 TEMPLE. Subsequently, he converted the latter asset into FRAX.

The exploit was caused by “several abuses” in the migrateStake function. It allows users to transfer staked tokens from an older contract. The attacker called the function with a forged address, granting access to withdraw all funds from the vault to his wallet instead of the new contract.

“The exploit is one of the most trivial in scale in recent times. […] The contract was deployed more than 100 days ago with a vulnerability that has only now been exploited”, — according to Paladin’s statement.

The operations were conducted from a Binance-registered account. Project representatives contacted the exchange’s security team.

Developers recommended avoiding depositing funds into STAX contracts.

The team pledged a bounty to the hacker if the stolen funds are returned.

Other storage facilities of the project were not affected and remain secure. According to DeFi Llama, the total value locked in TempleDAO is $109.8 million.

Earlier on Oct 11, an unknown withdrew more than $1 million from the QANplatform blockchain.

Earlier, Immunefi’s bug-bounty platform experts estimated the ecosystem Web3 losses from hacks and fraud for Q3 2022 at $428.7 million.

Of the overall figure, losses from hacking amounted to $399 million. The bulk of the losses were linked to two incidents — cross-chain protocol Nomad ($190 million) and market maker Wintermute ($160 million).

Read ForkLog’s Bitcoin news in our Telegram — crypto news, prices and analytics.