link.png

ID:

redacted-cartel-1112

Date:

Status:

Incident Count:

January 11, 2022

Near-Miss

1

info.png
target.png
REKT

Contributor:

chain.png

web3rekt.com

KYC By:

KYC:

None

info.png

Audit By:

Audits:

Omniscia

Loss Amount:

-

info.png

Recovered:

-

Rewards:

560,000

Currency:

USD

info.png

Key Indicators

Platform:

Type:

Category:

Method:

Data Sources:

Ethereum

Protocol

Derivatives

Near-Miss

Extended Method:

Logic error in custom approval

info.png

Days in Operation:

378

(1.04 Years)

chain.png
chain.png
chain.png
chain.png
datasource.png

The Redacted protocol is the dApp centered around BTRFLY, which allows users to stake, earn incentives, and interact with governance proposals.

Whitehat Tommaso Pifferi submitted a vulnerability in Redacted Cartel via Immunefi. The vulnerability was rated as critical because it would have allowed a malicious attacker to assign a user’s allowance to themselves, enabling the attacker to steal that user’s funds. Funds at risk were just under $6 million dollars. Redacted patched the bug and paid the whitehat $560,000 for his find.

The vulnerability here consisted of a faulty implementation of standard ERC-20 functions in REDACTED’s wxBTRFLY token, which is a wrapped version of the xBTRFLY. It was also inside the transferFrom function, but the issue was different. It allowed an attacker to take somebody else’s allowance and assign it to the attacker so she could steal funds from the user.

info.png

DISCLAIMER: While web3rekt has used the best efforts in aggregating and maintaining this database, this web site makes no representations or warranties with respect to the accuracy or completeness of its information and data herein, and specifically disclaim any implied warranties of merchantability or fitness for any particular purpose. 

Under no circumstances, shall web3rekt be liable for any loss of profit or funds, any regulatory or governmental penalties, any legal costs, or any other commercial and non-commercial damages, including but not limited to special, incidental, consequential, or other damages from any or all usage of the data and information derived from this database.