OSN

DESCRIPTION OF EVENTS

"OSN on BNBChain is suspected to have been attacked. The attacker initiated multiple attack transactions, resulting in a loss of ~$110K. The attacker took advantage of the OSNLpDividendTracker contract which sells its own tokens as a reward for users adding liquidity."

"According to Foresight News, SlowMist, a cybersecurity company, has issued a warning about potential suspicious activity related to OSN tokens on the BNB Chain. Users are advised to remain vigilant. Further details about the nature of the suspicious activity were not provided."

"In OSN token's _transfer function, when transfer to address is the liquidity pool, it uses the swapAndSendDividends function to sell its own tokens and sends the BUSD to the OSNLpDividendTracker."

"The attacker repeatedly bought and sold OSN tokens, causing the OSNLpDividendTracker contract to accumulate a large amount of rewards."

"As the OSNLpDividendTracker contract primarily distributes rewards to addresses that provide liquidity, the attacker used multiple attack contracts to add liquidity and gain the rewards from the OSNLpDividendTracker contract."

A protocol without any website or social media which could be found has been exploited. Named OSN, the protocol was reportedly offering tokens as a reward for providing liquidity. This enabled an attack where multiple contracts were deployed to add liquidity and gain all of the available rewards.

SlowMist Hacked - SlowMist Zone (May 28)
@SlowMist_Team Twitter (May 29)
Potential Suspicious Activity Detected On BNB Chain Related To OSN Tokens | Binance News on Binance Square (May 29)
BNB Smart Chain Transaction Hash (Txhash) Details | BscScan  (May 29)
BNB Smart Chain Token 0x810f4c6ae97bcc66da5ae6383cc31bd3670f6d13 - BSCTrace (May 29)
OSN on BNB Smart Chain  (May 29)
@ChainAegis Twitter (May 29)
BNB Smart Chain Transaction Hash (Txhash) Details | BscScan  (May 29)
@CertiKAlert Twitter (May 29)
OSN (OSN) Token Tracker | BscScan  (May 29)
Token Transfer | BscScan  (May 29)

More case studies

GNUS.ai Discord
Private Keys Exposed

Perpy Finance Contract
Initialization Issue