Binance Smart Chain DeFi Project Hacked for $31M

  modifier ifAdmin() {
    if (msg.sender == _admin()) { 
      _; // run the rest of the function being modified 
    } else {
      // for our case this essentially does nothing 
      _fallback();
    }
  }

  // imagine the code inside the function in place of the _ in ifAdmin
  function upgradeTo(address newImplementation) external ifAdmin {
    // actually upgrades the contract in place
    _upgradeTo(newImplementation);
  }

This can be seen here: https://bscscan.com/tx/0xecd169b3a299d28495cbc9bd22b5690e263...

So here it looks like the administrator was changed but as we know it actually didn't. Now users begin to use the platform and deposit funds.

Since the admin hasn't changed the developer calls upgradeTo and deploys a malicious change, seen here: https://bscscan.com/tx/0xf19fa4bcff4adaebeddd28c851458ba0f01...

This contract (https://bscscan.com/address/0xb2603fc47331e3500eaf053bd7a971...) is compiled so we can't easily see the source. This doesn't matter as we can easily see the resulting transactions (https://bscscan.com/tx/0x1332fadcc5378b1cc90159e603b99e0b73a... and https://bscscan.com/tx/0xd8145dfe255a671428b9c082a006a145fe5...).

Whats especially clever about this rug pull scam is that it is self contained. Instead of selling your tokens at an exchange which risks low liquidity and front running, the developer is in control the whole time and could have done this whenever he thought the deposits were enough.

Audits aren't the be all end all either, a determined scammers could have added the backdoor after the audit.

It's easier to think of them as the rules to a game, like chess. The smart contact defines the pieces and valid moves. The EVM enforces the rules.

A contract between two people is fundamentally an agreement that "If you do this, then I will do that", enforceable by law. It exists to allow trust: if you have no way of knowing what the other person is going to do in response, why would you ever do something like give them money or perform services for them? With smart contracts the legal system is replaced by a worldwide network of computers, and the actions that you can guarantee are restricted to quantities or properties represented on the blockchain. But the basic motivation and principal are the same: you want to provide guarantees about the future so that people can take mutually beneficial actions with them in mind.

If I understand correctly, there can't be any actual secrets; you have to read carefully, then caveat emptor.

As to the point of it, it's mostly about recycling the existing Ethereum ecosystem of dApps and allowing less wealthy people to play with it, even if the original motivation for it is lost. Kind of like a testnet network, except people put real money on it, and influencers mislead people about its real nature.

Am I right in understanding he's trying to withdraw USDC from Flow to Ethereum (https://support.meetdapper.com/hc/en-us/articles/36005912467...) and requires KYC and the process is actually centralised?

I'd have imagined that Cricle would have build a decentralised flowUSDC-ethUSDC bridge but perhaps there's a regulation reason which also explains the KYC requirements.

If this is the case, hopefully someone else can pick up the slack and create a Flow-Eth bridge/atomic swap.

In short:

* the smart contact is made in a way that allows upgrades by an administrator * the developers transfer their administrator privileges to another user as a show of good faith * the code to transfer the privileges actually doesn't do anything * the developers upgrade the contract giving themselves permission to take the funds

Then elsewhere on line 50, anybody who creates a Proxy object will automatically be made the admin with zero auth.

> The hackers implemented a change in the ownership of the smart contract address.

Well, wouldn't it already be quite a win if for 99.9% of the smart contract out there no human judge was needed?

It's an honest question: ain't it unthinkable that most could be fully automated and yet real courts could be used in rare cases and that that'd be already be quite an improvement? Or is the system only working if 100% of the time no human ruling is needed?

I have no idea...