BoosterToken Malicious Front-End

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Booster Token Homepage

The BoosterToken project swapped their front-end for a malicious front-end after getting a CertiK audit, enabling them to steal at least 120 BNB. Anyone who fell for the migration code on the website had their entire wallet drained of any funds. The website is presently offline and it does not appear that any recovery is likely.

About BoosterToken

"Booster Token is a decentralized financial payment network that rebuilds the traditional payment stack on the blockchain. It utilizes a basket of fiat-pegged stablecoins, algorithmically stabilized by its reserve currency BOOSTER, to facilitate programmable payments and open financial infrastructure development. As of December 2020, the network has transacted an estimated $299 billion for over 2 million users."

"Bought a couple hundred dollars worth. This coin is awesome. Hasn't even been 24 hours. Sounds like a great project. Enjoy the moon, early buyers!"

Homepage:

Twitter:

CoinMarketCap:

TheBitTimes:

YouTube Video:

The Reality

While the booster token had an audit from CertiK, this doesn't vouch for anything but the security of the submitted smart contract. By directing users to interact with a different smart contract or wallet, this is meaningless.

What Happened

The Booster Token project launched with users directed to grant access to an Ethereum wallet owned directly by the Booster Team, rather than the Booster Token smart contract.

Key Event Timeline - BoosterToken Malicious Front-End

Date	Event	Description
December 8th, 2021 10:56:00 AM MST	CertiK Reports Malicious Front-End	CertiK reports that "malicious frontend code was injected into @BoosterToken to mislead users into transferring the balance to an [externally owned account for the] Booster Team".
December 8th, 2021	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
December 8th, 2021 2:56:00 PM MST	CertiK Report On Losses	CertiK reports that they "have verified 3 of the scammers addresses" and that the loss is now ~ 120 BNB.

Technical Details

Exploiter Addresses:

Total Amount Lost

The total loss was estimated at 120 BNB.

"The total loss is now ~ 120 BNB."

The total amount lost has been estimated at $73,000 USD.

Immediate Reactions

A warning tweet was issued by CertiK. Several users also commented on the matter on Twitter.

Warning Tweet By CertiK

CertiK reported on the issue.

A malicious frontend code was injected into @BoosterToken to mislead users into transferring the balance to an [externally owned account] (Booster Team). The rugpull happened in the frontend, not from the smart contract. DO NOT engage

Reactions On Twitter

"This is not the Old booster account they deleted it and I took the @ we are investigating to see who was behing this attack... Revoke access to booster on BSC" "DONT MIGRATE ANYTHING ON THE WEBSITE IT WILL DRAIN YOUR ACCOUNT" "[T]hey are not just rug pulling they are stealing other tokens." "[T]hey took all I had in my wallet."

Ultimate Outcome

CertiK performed some tracing to identify 3 wallets owned by the scammer(s).

CertiK Address Confirmation

A follow up tweet provided three addresses involved in the fraud.

So far we have verified 3 of the scammers addresses: https://certik.com/skytrace/bsc:0xc8c4177aa32798ea53e1b8282e1f801a24f85ee9…… - (31.72 BNB) https://certik.com/skytrace/bsc:0x9aa3fbd5e93798b1816a5bc4bd74219cc4a1a789-…… (77.98 BNB) https://certik.com/skytrace/bsc:0x7433f75270fe707f6a7b1fdc7b93a2b398fc3b3d…… - (9.3 BNB)

The total loss is now ~ 120 BNB

Keep the eye on the addresses using #SkyTrace

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

TBD

Individual Prevention Policies

A high degree of diligence is needed when interacting with smart contracts. The user needs to ensure that the security of the smart contract has been assessed and that their funds are being sent to the correct smart contract.

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Users need to be better educated on the risks and how to validate that they are interacting with the correct smart contract. Having a standard review process for all smart contract projects would ensure that the teams are generally better known. An industry insurance fund can assist in selecting validators and if any projects defraud users.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Users need to be better educated on the risks and how to validate that they are interacting with the correct smart contract. Having a standard review process for all smart contract projects would ensure that the teams are generally better known. An industry insurance fund can assist in selecting validators and if any projects defraud users.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.