XSurge Reentrancy Attack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

XSurge

The XSurge smart contract was exploited and $5m was taken from investors.

It appears that XSurge is making efforts to recompensate affected users. They put out an initial snapshot of balances to be compensated. They also completed an audit with CertiK.

This is a global/international case not involving a specific country.

About XSurge

XSurge describes itself as "The Defi Revolution". "Explore our fast growing smart chain ecosystem that fosters innovation and encourages a truly decentralized future through on-chain liquidity, and fully renounced ownership."

"Each transaction triggers a fee that raises the price of Surge relative to its underlying asset. That means Buys, Transfers, and Sells raise the price." "6% fee to buy, 6% fee to sell, 7% fee to navigate between tokens (i.e., SETH to SBTC) & 2% fee for wallet-to-wallet transfers."

"In accordance with the our Security First Approach, we have undergone and completed third party verification of our SurgeETH Token Contract. The audit was conducted through Certik, a highly esteemed blockchain auditor. Using their in-house formal verification technology, Certik provides a thorough assessment that outlines vulnerability ranking scores for various factors. Following completion of the audit, we are happy to report SurgeETH has earned an admirable rating for these factors along with a very high Security Score. In addition, SurgeETH will be under 24/7 Skynet Monitoring from the Certik Dashboard to further assure our community that security and integrity are always our first priority."

"Surge even boasted a well-known developer from SafeMoon, SafemoonMark - SafeMoon CEO, John Karony, has since announced he is no longer apart of the team." "SafemoonMark came out as the to be the writer of Surge code and mentioned safety from Rug Pulls via a Tweet on July 30th."

"The Surge ETH Protocol is a decentralized finance (DeFi) token deployed on the Binance smart chain(BSC). Send BNB to this contract and it mints Surge Token to your receive address, then BNB will beexchanged for _token. _token is ETH. When selling Surge Token by interacting with the contract directly,the price is calculated as a ratio between the underlying asset of _token and total supply in the contract.When the user mistakenly transfers other tokens to this contract, owner can convert these tokens into_token."

“With ownership fully renounced, no liquidity, and no need for DApps, there is no possibility of a rug pull or whale dominance,” Is the lofty statement on the XSurge webpage. Although that has been categorically proven untrue, it does not stop others from being influenced.

“There is absolutely no risk of a rug pull! There is no liquidity, no dev tokens, no exchange or the possibility of whales monopolizing ownership.” This was the statement in the most recent Medium post by AG Digikemet, an apparent supporter and volunteer.

"In the same tweet XSurge noted that it had been a backdoor exploit, meaning normal processes had been bypassed. The team also tried to quell fears of a further attack by explaining that SurgeUSD and SurgeETH do not withdraw BNB and therefore cannot be exploited in the same manner."

"After an initial investigation, it seems to be a reentrancy-based price manipulation attack." "SURGEBNB got pwned by an external call before important state updates. A call to sell resulted in BnB being sent back to the user allowing an additional call to purchase(...) before the _totalSupply was updated."

"The attacker utilized the fallback function which would purchase surge tokens. They performed the sell/purchase attack about 8 times and profited ~12,161.157 BNB after paying off the flash loan."

"#SurgeFund Has Launched! Next 36 hours will be spent verifying with the community that our snapshot data was correct, then we will allow victims of August 16th to claim BNB daily, permitting there are funds available to claim!" "The CertiK audit for #SurgeETH is officially underway!"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - XSurge Reentrancy Attack
Date	Event	Description
August 16th, 2021 12:00:00 AM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $5,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

In general, smart contract funds should be considered as a form of hot wallet. Its better to have funds in offline multi-signature storage, which could be used for the majority of funds when the team is known. When not possible, there exist protocols to provide insurance, and an industry fund can serve as an alternative to ensure investors are protected.