Pnetwork Protocol Gets Hacked, Loses 277 Bitcoin on Binance Smart Chain

September 21, 2021 Bitcoin.com

Sushi’s Initial Offering Launchpad Suffers $3M Exploit

September 17, 2021 The Crypto Briefing

White hat potentially saves SushiSwap $350M by finding ‘obvious’ exploit

August 18, 2021 Coin Telegraph

White hat potentially saves SushiSwap 0M by finding ‘obvious’ exploit

BitDAO

The security researcher found a flaw in a dutch auction smart contract that could have resulted in the loss of 109,000 ETH.

The SushiSwap decentralized exchange has narrowly avoided becoming the latest DeFi hack victim thanks to assistance from a white hat hacker.

A security researcher from venture capital firm Paradigm known on Twitter as “samczsun” has managed to save SushiSwap and its MISO platform from a potential loss of as much as 109,000 ETH.

In a blog post published on Aug. 17, the programmer described how he began examining the smart contract code for the BitDAO token sale at SushiSwap’s token launchpad platform, MISO.

Just pulled off maybe the biggest whitehat rescue ever. Story time soon
— samczsun (@samczsun) August 17, 2021

On closer inspection, he found a flaw in the MISO Dutch auction contract whereby some of the functions lacked access controls.

“I didn’t really expect this to be a vulnerability though, since I didn’t expect the Sushi team to make such an obvious misstep.”

Upon deeper investigation, the white hat discovered a vulnerability that, if exploited, could result in all of the crypto assets in the token auction contract being drained by a malicious actor. An attacker could reuse the same ETH over and over to batch multiple calls to the contract and “bid in the auction for free.”

Samczsun tested the vulnerability with a successful exploit before contacting colleagues Georgios Konstantopoulos and Dan Robinson to take a look and double-check the findings. He also discovered that a hacker could steal the funds from the contract by triggering a refund by sending a higher amount of ETH than the auction hard cap.

“Suddenly, my little vulnerability just got a lot bigger. I wasn’t dealing with a bug that would let you outbid other participants. I was looking at a 350 million dollar bug.”

It was then time to reach out to SushiSwap CTO Joseph Delong to formulate a rescue plan before the exploit was discovered in the wild. It was decided that the BitDAO team holding the token sale would manually end the auction by purchasing the remaining allocation and immediately finalizing the process and rescuing the funds.

SushiSwap noted that no funds were lost in the salvage effort, adding that it will pause the use of its MISO Dutch auction format until the smart contract can be updated. Crypto community member “DC Investor” commented:

“Everyone knows Paradigm has big UNI / Uniswap bags, but Sam from their team just helped save SushiSwap (an ostensible competitor) from a critical bug. This is the ethos of the space among the best actors.”

The BitDAO token sale went off without a hitch raising more than 112,000 ETH, valued at roughly $336 million, from over 9,200 participants according to a tweet from the protocol on Aug. 17.

Gone in 31 seconds: Yield Guild Games’ IDO raises $12.5M from just 32 participants

July 28, 2021 Coin Telegraph

Gone in 31 seconds: Yield Guild Games’ IDO raises .5M from just 32 participants

Coin Telegraph

The $12.6 million initial DEX offering of play-to-earn collective, Yield Guild Games, sold out in just 31 seconds to just 32 participants.

Yield Guild Games (YGG), a collective of play-to-earn gamers, completed its initial DEX offering via SushiSwap’s Miso platform in under a minute earlier today.

The offering saw YGG raise roughly $12.5 million on July 27, with the token sale distributing 25 million tokens or 2.5% of the project’s 1 billion token supply via a dutch auction. The YGG tokens were sold for roughly $0.50 each.

Disappointed investors criticized the sale after 32 wallets exhausted the allocation in 31 seconds, even though YGG’s Discord membership exceeds 47,000.

A single address appears to have been able to nab 4.5 million tokens or 18% of the coins available in the offering, although onlookers have speculated the purchaser was likely a pool.

32 participants / Biggest ape (looks like a pool) did 4.5milly pic.twitter.com/EpR69WXKTT
— Darren Lau (@Darrenlautf) July 27, 2021

YGG co-founder, Gabby Dizon told Cointelegraph the project has been in touch with some of the buyers, noting the purchasing addresses represented groups of long-term community members who had “[pooled] capital together for a large purchase.”

“So it's not just 32 whales that bought in, it was 32 wallets that represented different groups of long term believers of our vision.”

Dizon also noted the token is scheduled to begin trading on SushiSwap later today with plenty of liquidity, providing investors additional opportunities to access the YGG token.

In a blog post, Dizon thanked the project’s community for its support and participation, stating: “We are looking forward to kicking off our community airdrop where YGG tokens will be given to the most active and engaged members of our guild, especially those who have been with us from the beginning.”

Moving forward, Yield Guild Games will soon complete a community airdrop distributing tokens to its most active members. The project will also launch a community mining program soon.

YGG also intends to expand its sponsorship program, which facilitates the donation of Axie Infinity in-game currency Small Love Potion (SLP) to YGG players for breeding Axies — collectible fantasy creatures that inhabit the game.

Last month, YGG raised $4 million in a Series A funding round featuring participation from Mechanism Capital, ParaFi Capital, and lead investor Bitkraft Ventures.

MISO