LABUBU Smart Contract Self-Transfer Vulnerability: Difference between revisions
(Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/labubusmartcontractselftransfervulnerability.php}} {{Unattributed Sources}} thumb|Labubu Logo/Plushy ToysLabubu is a popular plush toy brand created by Hong Kong designer Kasing Lung in 2015 as part of "The Monsters" series, which is inspired by Nordic folklore. Its partnership with Pop Mart in 2019 helped boost its recognition, and in 2024, the toy gained furth...") |
No edit summary |
||
| Line 2: | Line 2: | ||
{{Unattributed Sources}} | {{Unattributed Sources}} | ||
[[File:Labubutoken.jpg|thumb|Labubu Logo/Plushy Toys]]Labubu is a popular plush toy brand created by Hong Kong designer Kasing Lung in 2015 as part of "The Monsters" series, which is inspired by Nordic folklore. Its partnership with Pop Mart in 2019 helped boost its recognition, and in 2024, the toy gained further attention when Blackpink's Lisa was spotted with it, sparking a trend across Southeast and East Asia. Known for its playful yet mischievous design, Labubu has been produced in various forms and sizes. A new token named after Labubu was launched on the Binance Smart Chain. A suspicious attack involving a bug when self-transfering the new token resulted in a loss of approximately $11.9K.<ref name="bscscan-17505" /><ref name="wikipedia-17506" /><ref name="numbers19079000twitter-17507" /><ref name="tenarmoralerttwitter-17508" /><ref name="bscscan-17509" /><ref name="bscscan-17510" /><ref name="labubuofficial-17511" /><ref name="logosfandom-17512" /><ref name="labubuofficialtwitter-17513" /> | [[File:Labubutoken.jpg|thumb|Labubu Logo/Plushy Toys]]Labubu is a popular plush toy brand created by Hong Kong designer Kasing Lung in 2015 as part of "The Monsters" series, which is inspired by Nordic folklore. Its partnership with Pop Mart in 2019 helped boost its recognition, and in 2024, the toy gained further attention when Blackpink's Lisa was spotted with it, sparking a trend across Southeast and East Asia. Known for its playful yet mischievous design, Labubu has been produced in various forms and sizes. A new token named after Labubu was launched on the Binance Smart Chain. A suspicious attack involving a bug when self-transfering the new token resulted in a loss of approximately $11.9K.<ref name="bscscan-17505" /><ref name="wikipedia-17506" /><ref name="numbers19079000twitter-17507" /><ref name="tenarmoralerttwitter-17508" /><ref name="bscscan-17509" /><ref name="bscscan-17510" /><ref name="labubuofficial-17511" /><ref name="logosfandom-17512" /><ref name="labubuofficialtwitter-17513" /><ref name="newsletter-17521" /> | ||
== About Labubu == | == About Labubu == | ||
| Line 99: | Line 99: | ||
<ref name="logosfandom-17512">[https://logos.fandom.com/wiki/Labubu Labubu | Logopedia | Fandom] (Accessed Jan 23, 2025)</ref> | <ref name="logosfandom-17512">[https://logos.fandom.com/wiki/Labubu Labubu | Logopedia | Fandom] (Accessed Jan 23, 2025)</ref> | ||
<ref name="labubuofficialtwitter-17513">[https://twitter.com/LabubuOfficial @LabubuOfficial Twitter] (Accessed Jan 23, 2025)</ref></references> | <ref name="labubuofficialtwitter-17513">[https://twitter.com/LabubuOfficial @LabubuOfficial Twitter] (Accessed Jan 23, 2025)</ref> | ||
<ref name="newsletter-17521">[https://newsletter.blockthreat.io/p/blockthreat-week-50-2024 BlockThreat - Week 50, 2024] (Accessed Jan 24, 2025)</ref></references> | |||
Latest revision as of 16:15, 24 January 2025
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
Labubu is a popular plush toy brand created by Hong Kong designer Kasing Lung in 2015 as part of "The Monsters" series, which is inspired by Nordic folklore. Its partnership with Pop Mart in 2019 helped boost its recognition, and in 2024, the toy gained further attention when Blackpink's Lisa was spotted with it, sparking a trend across Southeast and East Asia. Known for its playful yet mischievous design, Labubu has been produced in various forms and sizes. A new token named after Labubu was launched on the Binance Smart Chain. A suspicious attack involving a bug when self-transfering the new token resulted in a loss of approximately $11.9K.[1][2][3][4][5][6][7][8][9][10]
About Labubu
Labubu is a plush toy brand created by Hong Kong designer Kasing Lung, initially introduced in 2015. The character is part of a series called "The Monsters," which is influenced by Nordic folklore and mythology that Lung enjoyed during his childhood. Labubu, along with other characters like Zimomo and Spooky, gained significant popularity after a collaboration with Pop Mart in 2019, leading to its widespread recognition. In 2024, the toy gained even more attention after Blackpink's Lisa was seen with it, sparking a trend across Southeast and East Asia.
Labubu toys are known for their playful yet mischievous design, featuring a round, furry body, wide eyes, pointed ears, and sharp teeth that create a mischievous smile. The toy's popularity has led to it being produced in various colors and sizes, including plush toys and vinyl figures. The partnership with Pop Mart has been a major success, with "The Monsters" line generating significant sales, amounting to 6.3 billion Chinese yuan ($870 million) in the first half of 2024. Labubu's rise in popularity has caused global "mania," with celebrities and fans flocking to acquire the toy.
About Labubu BSC
The Labubu smart contract on the Binance Smart Chain was created on December 9th, 2024.
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
A self-transfer bug was exploited in the Labubu smart contract.
| Date | Event | Description |
|---|---|---|
| December 9th, 2024 9:44:02 PM MST | Labubu Smart Contract Created | The Labubu token smart contract is first launched on Binance Smart Chain. |
| December 10th, 2024 6:19:16 AM MST | Binance Smart Chain Transaction | The attack transaction on the Binance Smart Chain. |
| December 10th, 2024 6:52:00 AM MST | TenArmor Analysis Published | TenArmor publishes an analysis of the exploit. At a high level, the issue is attributed to the transfer logic. |
| December 10th, 2024 6:58:00 AM MST | Analysis By @Numbers19079000 | The Twitter/X user @Numbers19079000 posts an analysis of the exploit along with the transfer logic. |
Technical Details
"The root cause lies in the flawed logic in handling self-transfers."
'If you use variables to store user balances just ask "what happens when you send tokens to yourself....."'
Total Amount Lost
The total amount lost has been estimated at $12,000 USD.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
"Our system has detected a suspicious attack involving #LABUBU on #BSC, resulting in an approximately loss of $11.9K."
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Total Amount Recovered
There do not appear to have been any funds recovered in this case.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ BNB Smart Chain Transaction Hash (Txhash) Details | BscScan (Accessed Jan 23, 2025)
- ↑ Labubu - Wikipedia (Accessed Jan 23, 2025)
- ↑ @Numbers19079000 Twitter (Accessed Jan 23, 2025)
- ↑ @TenArmorAlert Twitter (Accessed Jan 23, 2025)
- ↑ LABUBU (LABUBU) Token Tracker | BscScan (Accessed Jan 23, 2025)
- ↑ BNB Smart Chain Transaction Hash (Txhash) Details | BscScan (Accessed Jan 23, 2025)
- ↑ Labubuoffcial (Accessed Jan 23, 2025)
- ↑ Labubu | Logopedia | Fandom (Accessed Jan 23, 2025)
- ↑ @LabubuOfficial Twitter (Accessed Jan 23, 2025)