XSURGE

DESCRIPTION OF EVENTS

XSurge describes itself as "The Defi Revolution". "Explore our fast growing smart chain ecosystem that fosters innovation and encourages a truly decentralized future through on-chain liquidity, and fully renounced ownership."

"Each transaction triggers a fee that raises the price of Surge relative to its underlying asset. That means Buys, Transfers, and Sells raise the price." "6% fee to buy, 6% fee to sell, 7% fee to navigate between tokens (i.e., SETH to SBTC) & 2% fee for wallet-to-wallet transfers."

"In accordance with the our Security First Approach, we have undergone and completed third party verification of our SurgeETH Token Contract. The audit was conducted through Certik, a highly esteemed blockchain auditor. Using their in-house formal verification technology, Certik provides a thorough assessment that outlines vulnerability ranking scores for various factors. Following completion of the audit, we are happy to report SurgeETH has earned an admirable rating for these factors along with a very high Security Score. In addition, SurgeETH will be under 24/7 Skynet Monitoring from the Certik Dashboard to further assure our community that security and integrity are always our first priority."

"Surge even boasted a well-known developer from SafeMoon, SafemoonMark - SafeMoon CEO, John Karony, has since announced he is no longer apart of the team." "SafemoonMark came out as the to be the writer of Surge code and mentioned safety from Rug Pulls via a Tweet on July 30th."

"The Surge ETH Protocol is a decentralized finance (DeFi) token deployed on the Binance smart chain(BSC). Send BNB to this contract and it mints Surge Token to your receive address, then BNB will beexchanged for _token. _token is ETH. When selling Surge Token by interacting with the contract directly,the price is calculated as a ratio between the underlying asset of _token and total supply in the contract.When the user mistakenly transfers other tokens to this contract, owner can convert these tokens into_token."

“With ownership fully renounced, no liquidity, and no need for DApps, there is no possibility of a rug pull or whale dominance,” Is the lofty statement on the XSurge webpage. Although that has been categorically proven untrue, it does not stop others from being influenced.

“There is absolutely no risk of a rug pull! There is no liquidity, no dev tokens, no exchange or the possibility of whales monopolizing ownership.” This was the statement in the most recent Medium post by AG Digikemet, an apparent supporter and volunteer.

"In the same tweet XSurge noted that it had been a backdoor exploit, meaning normal processes had been bypassed. The team also tried to quell fears of a further attack by explaining that SurgeUSD and SurgeETH do not withdraw BNB and therefore cannot be exploited in the same manner."

"After an initial investigation, it seems to be a reentrancy-based price manipulation attack." "SURGEBNB got pwned by an external call before important state updates. A call to sell resulted in BnB being sent back to the user allowing an additional call to purchase(...) before the _totalSupply was updated."

"The attacker utilized the fallback function which would purchase surge tokens. They performed the sell/purchase attack about 8 times and profited ~12,161.157 BNB after paying off the flash loan."

"#SurgeFund Has Launched! Next 36 hours will be spent verifying with the community that our snapshot data was correct, then we will allow victims of August 16th to claim BNB daily, permitting there are funds available to claim!" "The CertiK audit for #SurgeETH is officially underway!"

The XSurge smart contract was exploited and $5m was taken from investors.

It appears that XSurge is making efforts to recompensate affected users. They put out an initial snapshot of balances to be compensated. They also completed an audit with CertiK.

HOW COULD THIS HAVE BEEN PREVENTED?

In general, smart contract funds should be considered as a form of hot wallet. Its better to have funds in offline multi-signature storage, which could be used for the majority of funds when the team is known. When not possible, there exist protocols to provide insurance, and an industry fund can serve as an alternative to ensure investors are protected.

Check Our Framework For Safe Secure Exchange Platforms

XSurge Faces $5,000,000 Exploit Despite Promises of Security (Aug 17)
Binance Transaction Hash (Txhash) Details | BscScan (Aug 17)
@XSURGEDEFI Twitter (Aug 17)
@MoonMark_ Twitter (Aug 17)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
@XSURGEDEFI Twitter (Aug 29)
@BlockSecTeam Twitter (Aug 29)
@unsafe_call Twitter (Aug 29)
xSurge - True Decentralized Finance.  (Sep 15)
Binance Transaction Hash (Txhash) Details | BscScan (Sep 19)
@XSURGEDEFI Twitter (Sep 19)
CertiK Security Leaderboard - Surge ETH (Sep 19)
@XSURGEDEFI Twitter (Sep 19)
@XSURGEDEFI Twitter (Sep 19)

More case studies

Ref Finance
Logic Error

SushiSwap MISO
White Hat Diffusal