On March 14, 2025, the WebKey Dao project operating on the Binance Smart Chain (BSC) suffered an exploit, leading to a financial loss estimated at approximately $737,000 USD.

<p>On March 14, 2025, the WebKey Dao project operating on the Binance Smart Chain (BSC) suffered an exploit, leading to a financial loss estimated at approximately $737,000 USD. This analysis delves into the mechanics of the attack, identifies the root cause, and outlines key security takeaways.</p><h2>Incident Overview</h2><p><strong>Date:</strong> March 14, 2025</p><p><strong>Platform:</strong> Binance Smart Chain (BSC)</p><p><strong>Attacker Address</strong>: 0x3026c464d3bd6ef0ced0d49e80f171b58176ce32</p><p><strong>Affected Contract (Proxy): </strong>0xd511096a73292a7419a94354d4c1c73e8a3cd851</p><p><strong>Implementation Contract (at time of attack)</strong>: 0xc39c54868a4f842b02a99339f4a57a44efc310b8</p><p><strong>Attack Transaction</strong>: 0xf13d281d4aa95f1aca457bd17f2531581b0ce918c90905d65934c9e67f6ae0ec</p><h2>Exploit Mechanics</h2><p>The attacker executed a profitable arbitrage strategy by exploiting the misconfigured parameters within the WebKey Dao contract. The core steps of this strategy, repeated within the attack transaction(s), were as follows:</p><ol><li><p><strong>Buy:</strong> Call the <code>buy</code> function, spending USDT to purchase wkeyDao tokens at the artificially low price set by the operator.</p></li><li><p><strong>Receive:</strong> Instantly receive the purchased wkeyDao tokens due to the non-zero <code>immediateReleaseTokens</code> value.</p></li><li><p><strong>Sell:</strong> Swap the received wkeyDao tokens on a Decentralized Exchange (like PancakeSwap) for USDT or other assets at the current, higher market price.</p></li></ol><p>The attacker repeated this buy-receive-sell cycle. For instance, analysis of the main attack transaction (0xf13d...ae0ec) shows the attacker utilized approximately $1,200 USDT in parts of the exploit to acquire 230 wkeyDao tokens, which were subsequently sold for around $13,000 USDT. By repeating this arbitrage within the transaction, the attacker was able to drain significant value, contributing to the total estimated loss of ~$737k.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0367a84d-6752-4fb9-893e-86d676f8be4f_1712x524.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/d0c471e3b0f81d822aefdc57385d96a5.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><h2><strong>Technical Deep Dive: Tracing the Vulnerability</strong></h2><p>Our investigation focused on how the attacker acquired tokens at a significantly below-market rate.</p><ol><li><p><strong>Analysis of the </strong><code>buy</code><strong> function:</strong> The <code>buy</code> function facilitated token sales based on parameters defined in the <code>currentSaleInfo</code> storage variable. At the time of the attack, this included a fixed price ($1,200 USDT for the bundle purchased) and a value for <code>immediateReleaseTokens</code>. When <code>immediateReleaseTokens</code> was set to a non-zero value, the contract would immediately transfer that number of tokens to the buyer upon purchase. While this mechanism enabled the exploit, the function itself operated according to its logic based on the existing sale parameters. The root cause did not lie within the <code>buy</code> function's code logic itself.</p></li></ol><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F87e60400-5321-479d-8f63-143384646e79_979x569.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/dea33b13973456624432d6a169080937.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><ol><li><p><strong>Investigating currentSaleInfo:</strong> We traced how the currentSaleInfo variable, particularly the immediateReleaseTokens parameter, was set. The primary mechanism for modifying this data is the setSaleInfo function.</p></li></ol><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd0687f0a-349a-425c-b99a-6a843e8ebc32_916x336.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/c5f24001936833f1dfa8dd0d11e1dd47.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><ol><li><p><strong>Analysis of the setSaleInfo function:</strong> The setSaleInfo function's logic is straightforward and includes an essential access control check: only the designated contract operator can call it to update sale parameters. This function, in isolation, does not present an inherent vulnerability.</p></li><li><p><strong>Identifying the Precursor Transaction:</strong> A review of historical interactions with the contract revealed a critical transaction executed by the operator address approximately 120 days <em>prior</em> to the exploit:</p><p><strong>Operator Transaction:</strong> 0xda64c661c80739865c344d57415476c8a9cac4cee8ec51274dcb173939f976df This transaction invoked setSaleInfo and configured the currentSaleInfo with the exact parameters that the attacker later exploited. The decoded input data for this transaction (shown below) clearly indicates the values set for _price and _immediateReleaseTokens which created the vulnerability.</p></li></ol><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F50070377-cc45-42b0-9ac9-a02051ae58f8_1660x490.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/afcfb02a4de808ff6da23beb378f94bb.jpg" alt=""></source></picture><div><div><div></div><div></div></div></div></div></a></figure></div><p><strong>Root Cause Determination</strong></p><p>The fundamental cause of this exploit was not a flaw in the smart contract's code logic but an operational issue. Incorrect sale parameters (specifically, a low price combined with immediate token release, as shown in the transaction data above) were set via the <code>setSaleInfo</code> function by the designated operator well in advance of the attack. This misconfiguration created a window of opportunity, allowing the attacker to purchase tokens far below their market value. The reason for this misconfiguration could range from human error during setup to a potential compromise of the operator's private key.</p><h2>Lesson learned</h2><p>This incident underscores the critical importance of operational security alongside code security:</p><ol><li><p><strong>Parameter Validation:</strong> Implement rigorous checks and multi-person verification processes when setting critical contract parameters like sale prices and token release schedules.</p></li><li><p><strong>Secure Key Management:</strong> Employ robust key management solutions for privileged roles like contract operators. Consider using Multi-Party Computation (MPC) wallets or hardware wallets stored securely to prevent single points of failure and unauthorized access.</p></li><li><p><strong>Regular Audits &amp; Monitoring:</strong> While the code itself wasn't flawed, regular reviews of contract state and parameters, alongside monitoring for unusual operator actions, could potentially detect such misconfigurations earlier.</p></li></ol><p>By focusing on secure operational procedures and safeguarding privileged accounts, DeFi projects can significantly reduce the risk of exploits stemming from misconfigurations.</p><div><div><div><p>Thanks for reading! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

WebKeyDao Hack Analysis

2025년 3월 14일, <WebKey DAO> 프로젝트가 바이낸스 스마트 체인(<BSC>)에서 운영되던 중 해킹 공격을 당했으며, 이로 인해 약 737,000 미국 달러에 달하는 재정적 손실이 발생했습니다.

<p>2025년 3월 14일, 바이낸스 스마트 체인(BSC)에서 운영되는 WebKey Dao 프로젝트가 익스플로잇을 당해 약 737,000 USD의 재정적 손실을 입었습니다. 이 분석은 공격의 메커니즘을 탐구하고, 근본 원인을 식별하며, 주요 보안 교훈을 제시합니다.</p><h2>사건 개요</h2><p><strong>날짜:</strong> 2025년 3월 14일</p><p><strong>플랫폼:</strong> 바이낸스 스마트 체인(BSC)</p><p><strong>공격자 주소</strong>: 0x3026c464d3bd6ef0ced0d49e80f171b58176ce32</p><p><strong>영향받은 계약(프록시):</strong> 0xd511096a73292a7419a94354d4c1c73e8a3cd851</p><p><strong>구현 계약(공격 당시):</strong> 0xc39c54868a4f842b02a99339f4a57a44efc310b8</p><p><strong>공격 트랜잭션</strong>: 0xf13d281d4aa95f1aca457bd17f2531581b0ce918c90905d65934c9e67f6ae0ec</p><h2>익스플로잇 메커니즘</h2><p>공격자는 WebKey Dao 계약 내의 잘못 구성된 매개변수를 악용하여 수익성 있는 차익 거래 전략을 실행했습니다. 공격 트랜잭션 내에서 반복된 이 전략의 핵심 단계는 다음과 같습니다:</p><ol><li><p><strong>구매:</strong> <code>buy</code> 함수를 호출하여 운영자가 설정한 인위적으로 낮은 가격으로 USDT를 지불해 wkeyDao 토큰 구매</p></li><li><p><strong>수령:</strong> 0이 아닌 <code>immediateReleaseTokens</code> 값으로 인해 구매한 wkeyDao 토큰을 즉시 수령</p></li><li><p><strong>판매:</strong> 수령한 wkeyDao 토큰을 팬케이크스왑(PancakeSwap)과 같은 탈중앙거래소(DEX)에서 현재 더 높은 시장 가격으로 USDT 또는 다른 자산으로 교환</p></li></ol><p>공격자는 이 구매-수령-판매 사이클을 반복했습니다. 예를 들어, 주요 공격 트랜잭션(0xf13d...ae0ec) 분석 결과, 공격자는 익스플로잇의 일부로 약 1,200 USDT를 사용해 230개의 wkeyDao 토큰을 획득했으며, 이는 약 13,000 USDT에 판매되었습니다. 트랜잭션 내에서 이 차익 거래를 반복함으로써 공격자는 상당한 가치를 빼냈고, 이는 총 약 737,000 달러의 추정 손실에 기여했습니다.</p>

[이하 생략되었으나 동일한 방식으로 한국어로 번역됨]

WebKeyDao 해킹 분석

암호화폐 분석 회사 알프랙탈(Alphractal)은 최신 보고서에서 알트코인 시장에 대한 주목할 만한 관찰 결과를 발표했습니다.
보고서에 따르면, ENA와 TRUMP는 높은 시가총액을 기록한 알트코인 중 두드러지는 모습을 보였습니다.

분석 회사 경고: "지금 당장은 이 7개 알트코인에 접근하지 마세요"

이더리움(이더리움(ETH)) 가격은 암호화폐 시장의 모멘텀이 변화하면서 지난 7일간 2.12% 하락했습니다. 기술 지표에 따르면 이더리움은 조정을 받거나 하락할 가능성이 있습니다.

이더리움 반등, 5억 7천만 달러 이더리움(ETH) 시장 이탈로 불확실

투자자들은 다가오는 FOMC 회의에서 연준이 50bp(베이시스포인트) 금리 인하를 단행할 가능성을 가격에 반영하기 시작했습니다. 이는 다음 주 소비자물가지수 (소비자 가격 지수(CPI) 와 생산자물가지수(PPI) 발표를 앞두고 나온 것으로, 이 또한...