Security News > 2021 > December > Smart Contract Bug Results in $31 Million Loss
A hacker stole $31 million from the blockchain company MonoX Finance , by exploiting a bug in software the service uses to draft smart contracts.
Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another.
MonoX updates prices after each swap by calculating new prices for both tokens.
When the swap is completed, the price of tokenInthat is, the token sent by the userdecreases and the price of tokenOutor the token received by the userincreases.
By using the same token for both tokenIn and tokenOut, the hacker greatly inflated the price of the MONO token because the updating of the tokenOut overwrote the price update of the tokenIn.
The hacker then exchanged the token for $31 million worth of tokens on the Ethereum and Polygon blockchains.
News URL
https://www.schneier.com/blog/archives/2021/12/smart-contract-bug-results-in-31-million-loss.html