Ethereum Gaming Altcoin Explodes 144% in Three Days Amid Partnership With The Rock and Mark Wahlberg

January 9, 2023 The Daily Hodl

Report: GALA token exploit resulted from public leak of private key on GitHub

November 7, 2022 Coin Telegraph

It appears that the leaked private key caused a change of ownership in the compromised smart contract 70 days prior.

According to a new post by blockchain security firm SlowMist on Nov. 7, it appears that the last week’s token exploit affecting GameFi project Gala Games resulted from a public leak of applicable security keys on GitHub. As told by SlowMist, pNetwork, the cross-chain interoperability bridge used by Gala Games on the BNB Smart Chain, had three privileged roles in its smart contract pGALA.

“The Admin role is used to manage upgrades and changes to the Admin address of the proxy contract. The DEFAULT_ADMIN_ROLE role is used to manage various privileged roles in the logic (eg: MINTER_ROLE ), and the MINTER_ROLE role manages the pGALA token minting authority.”

SlowMist went on to explain that both the DEFAULT_ADMIN_ROLE and MINTER_ROLE roles were controlled by pNetwork during initialization. Meanwhile, the proxy admin contract was an externally owned address responsible for upgrading the pGALA contract. However, the firm posted a screenshot alleging that the plaintext private key for the proxy admin owner address was exposed and publicly viewable on GitHub. Thus, any user with access to the private key could have manipulated the pGALA contract at any time. On Aug. 28, the proxy admin contract owner was replaced, making the protocol vulnerable to an attack.

The Gala Games token bridge was exploited on Nov. 3 after a single wallet address appeared to have minted over $2 billion in GALA (GALA) tokens out of thin air and dumped the tokens on decentralized exchange PancakeSwap. Around 12,977 BNB (BNB), worth $4.5 million, was drained from the liquidity pool.

Cryptocurrency exchange Huobi alleged the aforementioned activities were a scheme for profit orchestrated by pNetwork. The latter has denied such allegations, while also stating in its post-mortem analysis that “No funds loss happened on the GALA cross-chain bridge. All GALA tokens on Ethereum are safe.”

1/2 We strongly condemn as untruthful Huobi’s accusations against pNetwork and we will seek legal action accordingly.
We have documented proof showing that pNetwork has acted in good faith, that all actions were agreed upon in advance with GalaGames and that…
— pNetwork (@pNetworkDeFi) November 6, 2022

‘Everything is fine’ — Gala Games calls for calm after fears of multi-billion dollar hack

November 4, 2022 Coin Telegraph

Coin Telegraph

Gala Games said the unusual activity of its pGALA token was actually part of efforts to safeguard it from potential attack.

Blockchain gaming company Gala Games urged its community for calm after misplaced fears of a multi-billion dollar rug pull or hack caused the GALA token to temporarily crash 25.6%.

The initial panic, which Gala Games later implied was unfounded, came after a single wallet address appeared to mint over $2 billion GALA tokens out of thin air — which was flagged by blockchain security firm PeckShield on Nov. 3.

Fears that the unusual activity was a sign of an exploit or rug pull caused the GALA token price to drop a dramatic 25.6% from $0.0394 to $0.0293 over a 130-minute stretch late on Nov. 3, according to data from CoinGecko.

However, Gala Games took to Twitter on Nov. 4 to dispel the “FUD” surrounding its native token, explaining that “lots of people are tossing around words like ‘hack’ and ‘rug’. Neither of these is the case.”

Update for everyone - there is a LOT of FUD out there surrounding $GALA...lots of people tossing around words like "hack" and "rug". Neither of these is the case.

Here is the real story - read this update from @BitBenderBrink and @pNetworkDeFi. https://t.co/ruI16v2Lkv
— Gala Games - Spider Tanks is LIVE! (@GoGalaGames) November 4, 2022

Gala Games president for blockchain Jason Brink explained that the unusual activity detected on decentralized exchange (DEX) PancakeSwap was performed by pNetwork, who was working to drain the liquidity pool as a means to safeguard it from a potential vulnerability.

Before you panic about $GALA, please read this thread from @pNetworkDeFi.

TLDR: Everything is fine. The activity you have been seeing on @PancakeSwap is pNetwork working to drain the liquidity pool. GALA on ETH is completely unaffected.

Do not buy $pGALA on PancakeSwap for now https://t.co/bAnHxlVcp1
— Jason Brink aka BitBender (@BitBenderBrink) November 3, 2022

In a separate tweet, pNetwork, the cross-chain interoperability bridge used by Gala Games on the Binance Smart Chain, confirmed that a “misconfiguration” event took place. It also responded to a tweet from Peckshield to note that it “coordinated the white hat attack” to prevent pGALA from being exploited:

Yes, we noticed pGALA wasn’t to be considered safe anymore and coordinated the white hat attack to prevent pGALA from being maliciously exploited. Funds are safe but users should NOT transfer or buy/sell pGALA on pancakeswap
— pNetwork (@pNetworkDeFi) November 3, 2022

The explanations appear to have quelled some panic, with the GALA token price since partially recovered from its 24-hour low of $0.0293 to now sit at $0.352.

Gala Games confirmed that all GALA tokens on Ethereum and GALA-related assets on the GALA bridge were safe, the team, along with pNetwork informed the community of its decision to “temporarily suspend” transaction activity on the bridge.

Brink also advised not to buy pGALA on PancakeSwap “for now.”

"A new pGALA token will be created to replace the old compromised one” which will be sent to those who owned pGALA before the pool was drained, pNetwork said.

gala