Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/solaunverifiedcontractwithdrawtokenlackingaccesscontrol.php}} {{Unattributed Sources}} Binance Security ImageAn unverified smart contract at address 0x623c—possibly linked to the Sola Token—was exploited due to a critical lack of access control on its withdrawToken() function, allowing anyone to transfer tokens from it. The attacker used a maliciou..."

2025-08-27T21:36:18Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/solaunverifiedcontractwithdrawtokenlackingaccesscontrol.php}} {{Unattributed Sources}} thumb|Binance Security ImageAn unverified smart contract at address 0x623c—possibly linked to the Sola Token—was exploited due to a critical lack of access control on its withdrawToken() function, allowing anyone to transfer tokens from it. The attacker used a maliciou..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/solaunverifiedcontractwithdrawtokenlackingaccesscontrol.php}}
{{Unattributed Sources}}

[[File:Binancesecurity.jpg|thumb|Binance Security Image]]An unverified smart contract at address 0x623c—possibly linked to the Sola Token—was exploited due to a critical lack of access control on its withdrawToken() function, allowing anyone to transfer tokens from it. The attacker used a malicious contract and flash swap via PancakePair to obtain over 23,000 USDT and later repeated the process with another Sola token to extract 8.92 WBNB, leading to a total loss of approximately $28.1k. This marked the fourth in a series of similar attacks by a repeat offender, with no indication of recovery or ongoing investigation.<ref name="tenarmortweet-20932" /><ref name="attacktransaction-20933" /><ref name="certik-20934" /><ref name="blockthreat-20935" /><ref name="blockthreat2-20936" /><ref name="bscscanaddress-20937" /><ref name="bscscantransaction-20938" />

== About Unverified Smart Contract ==
The unverified smart contract was created on April 11th, 2025. It may be related to the Sola Token, however this is unconfirmed.

== The Reality ==
Decompilation and analysis of the victim contract revealed that the withdrawToken() function had no access restrictions—no onlyOwner modifier or require() checks—allowing any external address to call it and withdraw arbitrary tokens. This fundamental lack of access control made the function publicly callable, enabling the attacker to drain tokens without authorization. This poor design choice was confirmed via code decompilation, which showed no permission gating logic within the function.

== What Happened ==
An unverified contract possibly linked to the Sola Token was exploited for $28.1k due to a lack of access control on its withdrawToken() function, enabling a repeat attacker to execute a flash swap and drain funds without authorization.
{| class="wikitable"
|+Key Event Timeline - Sola Unverified Contract withdrawToken Lacking Access Control
!Date
!Event
!Description
|-
|April 10th, 2025 11:13:11 PM MDT
|Unverified Smart Contract Created
|The unverified smart contract is created on the Binance Smart Chain.
|-
|April 12th, 2025 3:19:11 AM MDT
|Smart Contract Attack Transaction
|The unverified smart contract attack is accepted as a valid transaction by the Binance Smart Chain.
|-
|April 12th, 2025 6:58:00 AM MDT
|TenArmor Posts Attack Overview
|TenArmor posts an overview of the mechanism behind the attack.
|}

== Technical Details ==
The smart contract reportedly allowed anyone to transfer tokens from it due to a lack of access control on the withdrawToken function.

On April 12, 2025, an unverified smart contract at address 0x623c was exploited due to a critical lack of access control, resulting in a loss of approximately $28,000.

The attacker initiated the exploit by sending 0.4 BNB to their own malicious contract at 0xD306.... They then assessed the Sola Token balance in the victim contract and calculated how much USDT could be obtained by swapping it. Utilizing the swap() function from PancakePair 0xdf9, the attacker initiated a flash swap, receiving 23,235 USDT upfront for 2,143,036 SOLA—before the SOLA was actually transferred to the liquidity pool.

To complete the swap and repay the protocol, the attacker then called the withdrawToken() function from the victim contract (0x623c...), which transferred the owed SOLA tokens to the swap pair. This allowed the swap to be finalized successfully without the attacker ever owning the SOLA tokens beforehand. The attacker repeated this process with another Sola token (0xef7), extracting 8.92 WBNB in a similar manner.

Contract Address: 0x623c1c6693e1425a7E691a0FF5C256Cb276522CA

This attack was part of a broader pattern by a repeat offender who had previously targeted Gemcy, OPC, and AIRWA, stealing around $181,000. A subsequent fifth exploit occurred on April 23, 2025, against ACB. The April 12 exploit targeted the Sola Token and used a malicious contract to abuse a vulnerable withdrawal function.

== Total Amount Lost ==
TenArmor reports that the loss is approximately $28.1k.

The total amount lost has been estimated at $28,000 USD.

== Immediate Reactions ==
It's unclear if there was any reaction from the team behind this unverified smart contract.

== Ultimate Outcome ==
The incident was reported on by TenArmor.

== Total Amount Recovered ==
There is no indication that funds have been recovered in this case.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
It is unclear if any investigation or potential recover is ongoing.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-20932">[https://twitter.com/TenArmorAlert/status/1911041324117032961 TenArmor - "Our system has detected a suspicious attack involving an unverified contract 0x623c1c6693e1425a7E691a0FF5C256Cb276522CA on #BSC, resulting in an approximately loss of $28.1K." - Twitter/X] (Accessed Aug 6, 2025)</ref>

<ref name="attacktransaction-20933">[https://bscscan.com/tx/0x9371eb4b0da7dedc95568d508a7fc97298a27bb44947c82dc4542fe3a4e5e3c9 The attack transaction happening in the Binance Smart Chain.] (Accessed Aug 6, 2025)</ref>

<ref name="certik-20934">[https://www.certik.com/resources/blog/sola-incident-analysis Sola Incident Analysis - CertiK] (Accessed Aug 6, 2025)</ref>

<ref name="blockthreat-20935">[https://newsletter.blockthreat.io/p/blockthreat-week-15-2025 Week 15, 2025 - BlockThreat] (Accessed Aug 6, 2025)</ref>

<ref name="blockthreat2-20936">[https://newsletter.blockthreat.io/p/blockthreat-week-20-2025 Week 20, 2025 - BlockThreat] (Accessed Aug 6, 2025)</ref>

<ref name="bscscanaddress-20937">[https://bscscan.com/address/0x623c1c6693e1425a7E691a0FF5C256Cb276522CA Unverified Smart Contract - BSCScan] (Accessed Aug 6, 2025)</ref>

<ref name="bscscantransaction-20938">[https://bscscan.com/tx/0x7d61611946f104e5ca0d2c23a7bbe7c8809fdec202187f1e4ee2f5f5dfbc68c7 Binance Transaction Hash: 0x7d61611946... | BscScan] (Accessed Aug 6, 2025)</ref></references>

Sola Unverified Contract withdrawToken Lacking Access Control - Revision history