$190 000 USD

APRIL 2024

GLOBAL

FENGSHOU (NGFS)

DESCRIPTION OF EVENTS

"Shortly after the deployment of the FENGSHOU (NGFS) token, it was attacked, resulting in a loss of approximately $191,000. The vulnerability lies in a public `delegateCallReserves` function which allows the attacker to set an arbitrary address to a UniSwapV2 proxy."

 

"The FENGSHOU (NGFS) Token was hacked shortly after deployment. The attack was a simple 3-step process which was possible because the deployer didn't initialize the contract properly.

 

1. The attacker called `delegateCallReserves` which sets the uniswapV2Proxy to msg.sender."

 

"2. Then it was easy for the attacker to set the `_uniswapV2Library` to any address he wants and to be able to call the third critical function."

 

"3. The `reserveMultiSync` allowed him to sync(transfer) all of the funds from the PancakeSwap BSC-USD - NGFS pool to his address. And just like that ~$191k has been affected."

 

"The data of the token and the pair are no longer updated as the token is SCAM" "Very high start liquidity, it looks like a scam!"

It is unclear the intent behind the launch of the NGFS (FENGSHOU) token, however it most likely wasn't to give an attacker full access to take all of the liquidity. A couple days after the token launched on April 23rd, an exploit took advantage of a delegateCallReserves vulnerability, which allowed the attacker to set whatever library smart contract he wanted, including a malicious one which transferred all the liquidity to themselves.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.