Originally published at https://blog.forcedao.com on April 4, 2021.
Dear Force Community, I’m writing this post to share further information with regards to the xFORCE contract exploit that began at around 7:06 am UTC.
- We take responsibility for this engineering oversight and have begun processes to ensure any such incidents are mitigated in the future.
- We also want to thank the White Hat hacker who helped deter further FORCE tokens from being drained. We have a bounty for you.
- All funds on our platform are safe, only xFORCE was affected. A total of 183 ETH (~$367K) worth of FORCE were drained and liquidated.
- For the time being, I can confirm that there will be a snapshot and new token. We’ve begun internal re-structuring and will be announcing a plan over the coming days making any affected FORCE holders and LPs whole.
Although this is an unfortunate event given the stage of our project, I’m confident we will continue to deliver the mission we’ve set for ourselves.
Below I share the following:
- Exploit Timeline
- Analysis
- Who was affected?
- Next Steps
Exploit Timeline
#1 White Hat:
#2 Black Hat:
- Address
https://etherscan.io/address/0x9d9c3695c54601929cd72d34a52935268eb9b00b - History
(Apr-04–2021 07:06:58 AM +UTC): Minted XForce: 347,432,986.72
(Apr-04–2021 07:08:12 AM +UTC): Drained Force: 4,112,106.01
(Apr-04–2021 07:17:33 AM +UTC): TX to sell Exploited: ~80 WETH
#3 Black Hat:
- Address
https://etherscan.io/address/0xe29a07002c7be4299b51a2892799cc4a372994dd - History
(Apr-04–2021 07:17:52 AM +UTC): Minted XForce 1,397,415,806.32
(Apr-04–2021 07:20:56 AM +UTC): Drained Force: 1,247,270.65
Multiple transactions to sell — Exploited: ~8 ETH
#4 Black Hat:
- Address
https://etherscan.io/address/0x0608576ea47b265f1f16b8b8383d0508f703a0cb - History
(Apr-04–2021 07:30:33 AM +UTC): Minted XForce: 98,886,515,072,039,900,000.89
(Apr-04–2021 07:30:31 AM +UTC): Minted XForce: 62,430,599,977,698,700,000
(Apr-04–2021 07:29:36 AM +UTC): Minted XForce: 45,657,805,079,781,200,000
(Apr-04–2021 07:31:46 AM +UTC): Drained Force: 156,847.45
Multiple transactions to sell — Exploited: ~50 ETH
#5 Black Hat:
- Address
https://etherscan.io/address/0x00000b20f0f6a3a212aa6b85106709cd5941457c - History
(Apr-04–2021 07:20:56 AM +UTC): Drained FORCE: 1,042,247
(Apr-04–2021 07:16:57 AM +UTC): Drained FORCE: 151,755
(Apr-04–2021 07:16:57 AM +UTC): Minted XForce: 84,826,216
(Apr-04–2021 07:20:56 AM +UTC): Minted XForce: 1,167,712,653
(Apr-04–2021 07:12:37 AM +UTC): Minted XForce: 845,089
Exploited: ~45 ETH
#6 ForceDAO Team
- At this time, 3 of the 5 Black Hat exploiters still had FORCE tokens in their addresses, and were able to sell for ETH.
- Our team made an executive decision at around 8am EST, to transfer 60M FORCE tokens from the treasury multisig into a deployer wallet to create and execute 3 votes that would effectively burn the FORCE balances in the 3 Black Hat addresses.
- First Txn:
https://etherscan.io/tx/0xb02206a51c6f3d836610a3b394c2c3f74acc22d57a8e9b6ae298ba87197752df
Analysis
- The xFORCE vault is a xSUSHI contract fork. The implementation used assumes tokens revert the transaction on failure. https://github.com/ForceDAO/contracts/blob/master/contracts/ForceProfitSharing.sol#L43
- The token used by Force DAO is an Aragon Minime token that returns a false bool if “transferFrom” fails (instead of reverting).
https://github.com/aragon/minime/blob/master/contracts/MiniMeToken.sol#L174 - The exploiters were able to deposit FORCE tokens that would fail the transferFrom call and receive xFORCE tokens, as the xFORCE contract expects a revert from the token but instead receives false.
- A user could then withdraw these newly minted xFORCE tokens for the remaining FORCE tokens in the vault, and liquidate them for ETH on exchanges.
- This could’ve been prevented by using a standard Open Zeppelin ERC-20 or adding a safeTransferFrom wrapper in the xSUSHI contract.
Who was affected?
- Force, xForce, and Force/ETH LPs on UniSwap and SushiSwap were affected
- ForceDAO strategy, vault and reward pool contracts were not affected.
Next Steps
We’re currently engaged with 2 separate security firms to review and analyze our repos to ensure all contract systems perform as designed.
Over the coming days, our team will announce a plan to re-launch xFORCE — with a snapshot and new token. We continue to investigate the event with the relevant authorities as some of the addresses originated from FTX and Binance.
After everything is said and done, I continue to a have a deep belief in the success of Force DAO. We will take care of our community and I’m excited to share the products we’ve been working on after xFORCE is live.
Thank you,
Alberto
Originally published at https://blog.forcedao.com on April 4, 2021.
