ID:
redacted-cartel-1112
100 pts
Platform:
Type:
Category:
Method:
Data Sources:
Ethereum
Protocol
Derivatives
Near-Miss
Extended Method:
Logic error in custom approval
Days in Operation:
378
(1.04 Years)
100 pts each
The Redacted protocol is the dApp centered around BTRFLY, which allows users to stake, earn incentives, and interact with governance proposals.
Whitehat Tommaso Pifferi submitted a vulnerability in Redacted Cartel via Immunefi. The vulnerability was rated as critical because it would have allowed a malicious attacker to assign a user’s allowance to themselves, enabling the attacker to steal that user’s funds. Funds at risk were just under $6 million dollars. Redacted patched the bug and paid the whitehat $560,000 for his find.
The vulnerability here consisted of a faulty implementation of standard ERC-20 functions in REDACTED’s wxBTRFLY token, which is a wrapped version of the xBTRFLY. It was also inside the transferFrom function, but the issue was different. It allowed an attacker to take somebody else’s allowance and assign it to the attacker so she could steal funds from the user.
DISCLAIMER: While web3rekt has used the best efforts in aggregating and maintaining this database, this web site makes no representations or warranties with respect to the accuracy or completeness of its information and data herein, and specifically disclaim any implied warranties of merchantability or fitness for any particular purpose.
Under no circumstances, shall web3rekt be liable for any loss of profit or funds, any regulatory or governmental penalties, any legal costs, or any other commercial and non-commercial damages, including but not limited to special, incidental, consequential, or other damages from any or all usage of the data and information derived from this database.