SpankChain Smart Contract Compromised, Hackers Take $38,000 in Ethereum (ETH)

Spread the love

Blockchain-based adult entertainment protocol SpankChain revealed the theft of 165.8 ether (ETH), worth $38,000 at the time. The move occurred after hackers exploited a smart contract bug on the protocol, according to an official release on Oct.9.

SPANK is “Spanked”

As stated, the hack took place on Oct.6 when the SpankChain team was investigating multiple bugs on the $22.4 million-valued protocol. Of the total haul, 34.99 ETH and 1271.88 BOOTY tokens – which are generated when SPANK tokens are staked–belonged to users, and SpankChain owned the remainder.

The team swiftly took their Spank.Live streaming service offline on locating the theft, and have since closed their camsite to prevent the transactions of stolen funds into the payment channel’s smart contract. Interestingly, the team found out about the hack on Oct.7, a day later than the actual theft.

For the uninitiated, SpankChain’s is a multi-token protocol which utilizes SPANK tokens for staking purposes and creating smart contracts. Upon staking, users receive BOOTY tokens in proportion to their staked amount for use in purchasing the site’s services and tipping models. The latter are redeemable for SPANK tokens in the so-called SpankBank, and nefarious access to BOOTY tokens means free money for hackers if they encashed swiftly.

The team announced a refund of stolen funds to its users and are preparing an ETH and BOOTY airdrop worth $9,300–the amount stolen from user funds – to cover losses and create a strong brand image. Airdropped tokens will be deposited to a user’s SpankBank account and made available when Spank.Live is rebooted, with the team guaranteeing the tokens credited once all systems are running again.

SpankChain explained that the delay in launching the camsite is due to security and development reasons. The team is aiming to patch all bugs in the network, update Spank.Live with a new smart contract to prevent a repeat, and fix bugs discovered during the BOOTY upgrade.

As part of the smart contract’s inbuilt security, 4,000 BOOTY tokens were “immobilized” when the theft took place. However, while the site will function as normal, the locked tokens mean SpankChain will reduce the BOOTY limit for each viewer to ten per user–allowing tips of no more than the amount. Users depositing extra ETH without knowledge of this point need not despair as well, as additional funds shall be immediately recharged in tranches of 10 BOOTYs.

Attack Explained

Explaining the attack, the team believe hackers infiltrated a known “reentrancy” bug–the same fallacy explained the infamous DAO hack. Attackers created a smart contract disguised as an ERC20 token, where the “transfer” function allowed “paid” funds to be sent into the payment channel contract multiple times.

The malicious contract opened up a payment channel and allowed hackers to enter and exit the contract without the presence of a counter-party. Unfortunately, the native “LCOpenTimeout” function caused only on-chain to be deleted, and let hackers conduct another payment into the same contract; thus creating a loop. By transferring tokens to the smart contract and back, hackers were able to gain ETH equivalent to their initial SPANK balance.

SpankChain admitted they decided against a security audit for the payment channel contract, citing expensive cost. The company hired blockchain audit firm Zeppelin for investigating a unidirectional channels library bug but faced a conundrum when the audit’s fee of $17,000 exceeded the funds held by the contract.

In conclusion, the team noted all security bugs have been identified and are currently being repaired. Also, they are making it mandatory for multiple “internal” audits for all smart contract codes published on the SpankChain protocol, and “at least” one external audit.

For those interested, SpankChain has made public the hacker’s payment channel contract, attacker’s address, internal attacker’s address, malicious contract address.

The post SpankChain Smart Contract Compromised, Hackers Take $38,000 in Ethereum (ETH) appeared first on BitcoinLinux.

loading…

Comments (281)

  1. AaronBef Oct 11, 2018
  2. AaronBef Oct 11, 2018
  3. CharlesAxods Oct 11, 2018
  4. Bennyrak Oct 11, 2018
  5. AaronBef Oct 11, 2018
  6. AaronBef Oct 11, 2018
  7. CharlesAxods Oct 11, 2018
  8. AaronBef Oct 11, 2018
  9. Bennyrak Oct 11, 2018
  10. BrettMyday Oct 11, 2018
  11. AaronBef Oct 11, 2018
  12. AaronBef Oct 11, 2018
  13. CharlesAxods Oct 11, 2018
  14. KennethHyday Oct 11, 2018
  15. Bennyrak Oct 11, 2018
  16. AaronBef Oct 11, 2018
  17. AaronBef Oct 11, 2018
  18. KennethHyday Oct 11, 2018
  19. Bennyrak Oct 11, 2018
  20. CharlesAxods Oct 11, 2018
  21. AaronBef Oct 11, 2018
  22. AaronBef Oct 11, 2018
  23. AaronBef Oct 11, 2018
  24. CharlesAxods Oct 11, 2018
  25. AaronBef Oct 11, 2018
  26. CharlesAxods Oct 11, 2018
  27. AaronBef Oct 11, 2018
  28. Alfredaricy Oct 11, 2018
  29. KennethHyday Oct 11, 2018
  30. Bennyrak Oct 11, 2018
  31. AaronBef Oct 11, 2018
  32. Alfredaricy Oct 11, 2018
  33. KennethHyday Oct 11, 2018
  34. Bennyrak Oct 11, 2018
  35. AaronBef Oct 11, 2018
  36. Alfredaricy Oct 11, 2018
  37. KennethHyday Oct 11, 2018
  38. Bennyrak Oct 11, 2018
  39. AaronBef Oct 11, 2018
  40. BrettMyday Oct 11, 2018
  41. Josephsmard Oct 11, 2018
  42. KennethHyday Oct 11, 2018
  43. AaronBef Oct 11, 2018
  44. AaronBef Oct 11, 2018
  45. Alfredaricy Oct 11, 2018
  46. Bennyrak Oct 11, 2018
  47. CharlesAxods Oct 11, 2018
  48. AaronBef Oct 11, 2018
  49. AaronBef Oct 11, 2018
  50. CharlesAxods Oct 11, 2018
  51. AaronBef Oct 11, 2018
  52. AaronBef Oct 11, 2018
  53. AaronBef Oct 11, 2018
  54. Alfredaricy Oct 11, 2018
  55. CharlesAxods Oct 11, 2018
  56. Bennyrak Oct 11, 2018
  57. BrettMyday Oct 11, 2018
  58. AaronBef Oct 11, 2018
  59. CharlesAxods Oct 11, 2018
  60. AaronBef Oct 11, 2018
  61. AaronBef Oct 11, 2018
  62. Alfredaricy Oct 11, 2018
  63. KennethHyday Oct 11, 2018
  64. AaronBef Oct 11, 2018
  65. CharlesAxods Oct 11, 2018
  66. Alfredaricy Oct 11, 2018
  67. KennethHyday Oct 11, 2018
  68. AaronBef Oct 11, 2018
  69. AaronBef Oct 11, 2018
  70. Josephsmard Oct 11, 2018
  71. AaronBef Oct 11, 2018
  72. BrettMyday Oct 11, 2018
  73. CharlesAxods Oct 11, 2018
  74. AaronBef Oct 11, 2018
  75. AaronBef Oct 11, 2018
  76. CharlesAxods Oct 11, 2018
  77. AaronBef Oct 11, 2018
  78. AaronBef Oct 11, 2018
  79. Alfredaricy Oct 11, 2018
  80. CharlesAxods Oct 11, 2018
  81. AaronBef Oct 11, 2018
  82. Alfredaricy Oct 11, 2018
  83. Bennyrak Oct 11, 2018
  84. BrettMyday Oct 11, 2018
  85. AaronBef Oct 11, 2018
  86. AaronBef Oct 11, 2018
  87. Alfredaricy Oct 11, 2018
  88. Bennyrak Oct 11, 2018
  89. Alfredaricy Oct 11, 2018
  90. AaronBef Oct 11, 2018
  91. Bennyrak Oct 11, 2018
  92. AaronBef Oct 11, 2018
  93. Josephsmard Oct 11, 2018
  94. Alfredaricy Oct 11, 2018
  95. AaronBef Oct 11, 2018
  96. Bennyrak Oct 11, 2018
  97. CharlesAxods Oct 11, 2018
  98. CharlesAxods Oct 11, 2018
  99. AaronBef Oct 11, 2018
  100. Bennyrak Oct 11, 2018
  101. CharlesAxods Oct 11, 2018
  102. CharlesAxods Oct 11, 2018
  103. Alfredaricy Oct 11, 2018
  104. Bennyrak Oct 11, 2018
  105. AaronBef Oct 11, 2018
  106. AaronBef Oct 11, 2018
  107. CharlesAxods Oct 11, 2018
  108. BrettMyday Oct 11, 2018
  109. Stewartjoili Oct 11, 2018
  110. AaronBef Oct 11, 2018
  111. Bennyrak Oct 11, 2018
  112. AaronBef Oct 11, 2018
  113. CharlesAxods Oct 11, 2018
  114. AaronBef Oct 11, 2018
  115. AaronBef Oct 11, 2018
  116. Bennyrak Oct 11, 2018
  117. AaronBef Oct 11, 2018
  118. CharlesAxods Oct 11, 2018
  119. Alfredaricy Oct 11, 2018
  120. Bennyrak Oct 11, 2018
  121. AaronBef Oct 11, 2018
  122. AaronBef Oct 11, 2018
  123. CharlesAxods Oct 11, 2018
  124. AaronBef Oct 11, 2018
  125. AaronBef Oct 11, 2018
  126. CharlesAxods Oct 11, 2018
  127. Bennyrak Oct 11, 2018
  128. AaronBef Oct 11, 2018
  129. AaronBef Oct 11, 2018
  130. AaronBef Oct 11, 2018
  131. Alfredaricy Oct 11, 2018
  132. Bennyrak Oct 11, 2018
  133. AaronBef Oct 11, 2018
  134. AaronBef Oct 11, 2018
  135. CharlesAxods Oct 11, 2018
  136. AaronBef Oct 11, 2018
  137. AaronBef Oct 11, 2018
  138. AaronBef Oct 11, 2018
  139. CharlesAxods Oct 11, 2018
  140. AaronBef Oct 11, 2018
  141. Bennyrak Oct 11, 2018
  142. AaronBef Oct 11, 2018
  143. AaronBef Oct 11, 2018
  144. Alfredaricy Oct 11, 2018
  145. Bennyrak Oct 11, 2018
  146. AaronBef Oct 11, 2018
  147. CharlesAxods Oct 11, 2018
  148. AaronBef Oct 11, 2018
  149. AaronBef Oct 11, 2018
  150. Alfredaricy Oct 11, 2018
  151. Bennyrak Oct 11, 2018
  152. AaronBef Oct 11, 2018
  153. CharlesAxods Oct 11, 2018
  154. AaronBef Oct 11, 2018
  155. AaronBef Oct 11, 2018
  156. AaronBef Oct 11, 2018
  157. Bennyrak Oct 11, 2018
  158. CharlesAxods Oct 11, 2018
  159. AaronBef Oct 11, 2018
  160. AaronBef Oct 11, 2018
  161. Bennyrak Oct 11, 2018
  162. AaronBef Oct 11, 2018
  163. CharlesAxods Oct 11, 2018
  164. AaronBef Oct 11, 2018
  165. AaronBef Oct 11, 2018
  166. Alfredaricy Oct 11, 2018
  167. Bennyrak Oct 11, 2018
  168. AaronBef Oct 11, 2018
  169. CharlesAxods Oct 11, 2018
  170. AaronBef Oct 11, 2018
  171. AaronBef Oct 11, 2018
  172. Alfredaricy Oct 11, 2018
  173. Bennyrak Oct 11, 2018
  174. AaronBef Oct 11, 2018
  175. CharlesAxods Oct 11, 2018
  176. AaronBef Oct 11, 2018
  177. AaronBef Oct 11, 2018
  178. Alfredaricy Oct 11, 2018
  179. Bennyrak Oct 11, 2018
  180. AaronBef Oct 11, 2018
  181. CharlesAxods Oct 11, 2018
  182. AaronBef Oct 11, 2018
  183. Alfredaricy Oct 11, 2018
  184. AaronBef Oct 11, 2018
  185. Bennyrak Oct 11, 2018
  186. AaronBef Oct 11, 2018
  187. AaronBef Oct 11, 2018
  188. CharlesAxods Oct 11, 2018
  189. Alfredaricy Oct 11, 2018
  190. AaronBef Oct 11, 2018
  191. AaronBef Oct 11, 2018
  192. Bennyrak Oct 11, 2018
  193. AaronBef Oct 11, 2018
  194. CharlesAxods Oct 11, 2018
  195. Alfredaricy Oct 11, 2018
  196. Bennyrak Oct 11, 2018
  197. AaronBef Oct 11, 2018
  198. AaronBef Oct 11, 2018
  199. Alfredaricy Oct 11, 2018
  200. Bennyrak Oct 11, 2018
  201. AaronBef Oct 11, 2018
  202. AaronBef Oct 11, 2018
  203. BillySag Oct 11, 2018
  204. BrettMyday Oct 11, 2018
  205. Stewartjoili Oct 11, 2018
  206. AaronBef Oct 11, 2018
  207. Alfredaricy Oct 11, 2018
  208. Bennyrak Oct 11, 2018
  209. AaronBef Oct 11, 2018
  210. AaronBef Oct 11, 2018
  211. AaronBef Oct 11, 2018
  212. Alfredaricy Oct 11, 2018
  213. Bennyrak Oct 11, 2018
  214. AaronBef Oct 11, 2018
  215. AaronBef Oct 11, 2018
  216. AaronBef Oct 11, 2018
  217. Alfredaricy Oct 11, 2018
  218. AaronBef Oct 11, 2018
  219. AaronBef Oct 11, 2018
  220. Alfredaricy Oct 11, 2018
  221. Bennyrak Oct 11, 2018
  222. AaronBef Oct 11, 2018
  223. AaronBef Oct 11, 2018
  224. AaronBef Oct 11, 2018
  225. Alfredaricy Oct 11, 2018
  226. AaronBef Oct 11, 2018
  227. AaronBef Oct 11, 2018
  228. Bennyrak Oct 11, 2018
  229. AaronBef Oct 11, 2018
  230. Alfredaricy Oct 11, 2018
  231. AaronBef Oct 11, 2018
  232. AaronBef Oct 11, 2018
  233. BillySag Oct 11, 2018
  234. BrettMyday Oct 11, 2018
  235. AaronBef Oct 11, 2018
  236. Stewartjoili Oct 11, 2018
  237. Alfredaricy Oct 11, 2018
  238. Bennyrak Oct 11, 2018
  239. AaronBef Oct 11, 2018
  240. AaronBef Oct 11, 2018
  241. AaronBef Oct 11, 2018
  242. Alfredaricy Oct 11, 2018
  243. Bennyrak Oct 11, 2018
  244. AaronBef Oct 11, 2018
  245. AaronBef Oct 11, 2018
  246. AaronBef Oct 11, 2018
  247. Alfredaricy Oct 11, 2018
  248. Bennyrak Oct 11, 2018
  249. AaronBef Oct 11, 2018
  250. AaronBef Oct 11, 2018
  251. AaronBef Oct 11, 2018
  252. Alfredaricy Oct 11, 2018
  253. Bennyrak Oct 11, 2018
  254. AaronBef Oct 11, 2018
  255. AaronBef Oct 11, 2018
  256. Bennyrak Oct 11, 2018
  257. AaronBef Oct 11, 2018
  258. AaronBef Oct 11, 2018
  259. Alfredaricy Oct 11, 2018
  260. Bennyrak Oct 11, 2018
  261. AaronBef Oct 11, 2018
  262. AaronBef Oct 11, 2018
  263. AaronBef Oct 11, 2018
  264. Alfredaricy Oct 11, 2018
  265. Bennyrak Oct 11, 2018
  266. AaronBef Oct 11, 2018
  267. AaronBef Oct 11, 2018
  268. AaronBef Oct 11, 2018
  269. Alfredaricy Oct 11, 2018
  270. Bennyrak Oct 11, 2018
  271. AaronBef Oct 11, 2018
  272. BrettMyday Oct 11, 2018
  273. Stewartjoili Oct 11, 2018
  274. AaronBef Oct 11, 2018
  275. Alfredaricy Oct 11, 2018
  276. AaronBef Oct 11, 2018
  277. Bennyrak Oct 11, 2018
  278. AaronBef Oct 11, 2018
  279. AaronBef Oct 11, 2018
  280. AaronBef Oct 11, 2018
  281. Alexabuff Oct 11, 2018

Leave a Reply