Matez Gaming Token Smart Contract Integer Truncation
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
Matez is a gaming token primarily promoted through Facebook and YouTube. The smart contract does not appear to have ever received any audit. On November 21st, the smart contract suffered from an exploit due to a truncation when integer types are converted. There were a number of copycats who performed similar exploits after the original $80k exploit. It does not appear that the team has addressed any losses, though they are still responding and have subsequently posted on Telegram.[1][2][3][4][5][6][7][8][9][10][11][12][13]
About Matez Gaming Token
"Our vision is to empower gamers with true ownership of in-game assets, seamless play-to-earn opportunities, and secure, transparent transactions. We aim to unite a global gaming community through blockchain innovation, creating a fair and inclusive ecosystem for all. Join the revolution with Matez Gaming Token!"
"Our mission is to revolutionize the gaming industry by empowering players with true ownership of assets, enabling play-to-earn opportunities, and fostering a global, inclusive gaming community powered by blockchain technology. Play. Earn. Own. With Matez Gaming Token!"
"1. Earn Rewards While You Play: With Matez, your gaming skills have tangible value. Earn Matez tokens by completing levels, defeating opponents, and achieving milestones in your favorite games. The more you play, the more you earn!
2. Seamless Integration: Say goodbye to complicated processes. Matez seamlessly integrates with leading gaming platforms, making it easy for you to start earning rewards without any hassle.
3. Community-driven: Join a thriving community of gamers and crypto enthusiasts. Engage with like-minded individuals, share strategies, and participate in exclusive tournaments and events hosted by Matez.
4. Secure and Transparent: Your security is our top priority. Built on the latest blockchain technology, Matez ensures secure transactions and complete transparency, giving you peace of mind with every move you make."
"We’re excited to share an inspiring experience from one of our leaders in Bangladesh, Azizul Islam. Azizul has been a dedicated Matezian and a source of guidance for our team, consistently embodying the values and drive that make Matez special. His journey with Matez has brought invaluable insights, challenges, and victories, demonstrating the impact of our community and vision in Bangladesh. As we grow together, stories like Azizul’s remind us of the power of resilience, collaboration, and shared purpose. Let’s take this moment to celebrate his contributions a
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
SlowMist reports that "Matez (MATEZ) on BSC is suspected to have been attacked, resulting in a loss of at least $80K."
| Date | Event | Description |
|---|---|---|
| November 12th, 2024 2:52:00 AM MST | Facebook Post From Leader | Azizul Islam, one of the leaders of the project, shares a compassionate speech on Facebook. |
| November 21st, 2024 9:10:47 PM MST | Binance Smart Chain Transaction | The malicious transaction happens on Binance Smart Chain. |
| November 21st, 2024 10:26:00 PM MST | TenArmorAlert Posts Tweet | TenArmorAlert reports that their system has detected multiple suspicious attacks involving the #MATEZ Token (@Matezofficial) on the Binance Smart Chain (BSC), resulting in a loss of at least $80K. The attacks exploit an integer truncation vulnerability in the stake function of the MatezStakingProgram contract. This flaw allows attackers to transfer a zero amount of tokens while the contract incorrectly recognizes it as a large stake, enabling them to claim tokens as profit. Numerous copycat transactions have occurred. The biggest beneficiary of these exploits has gained about $70K. |
| December 25th, 2024 4:47:26 AM MST | YouTube Promotion Posted | A promotion is made on YouTube with music by Hindi artist Vanshika Dixit. |
Technical Details
"It appears that the stake function of the MatezStakingProgram contract contains a classic integer truncation vulnerability.
This flaw allowed the attacker to transfer a zero amount of tokens while being recognized by the contract as having staked a large amount. Consequently, the attacker was able to claim tokens as profit.
Lots of copycat txns."
Total Amount Lost
The total amount lost has been estimated at $80,000 USD.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
SlowMist reports that "Matez (MATEZ) on BSC is suspected to have been attacked, resulting in a loss of at least $80K."
The TenArmorAlert system reported detecting "multiple suspicious attacks involving #MATEZ Token @Matezofficial on #BSC, resulting in an approximately loss of at least $80K so far."
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Total Amount Recovered
The total amount recovered is unknown.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ BNB Smart Chain Transaction Hash (Txhash) Details | BscScan (Accessed Jan 13, 2025)
- ↑ MATEZ/USDT Real-time On-chain PancakeSwap v3 (BSC) DEX Data (Accessed Jan 13, 2025)
- ↑ Matez (MATEZ) Token Tracker | BscScan (Accessed Jan 13, 2025)
- ↑ Matez (MATEZ) live coin price, charts, markets & liquidity (Accessed Jan 13, 2025)
- ↑ Crypto Security Incidents November 2024 (Accessed Jan 13, 2025)
- ↑ Matez (MATEZ) - Price & Chart | Coinranking (Accessed Jan 13, 2025)
- ↑ Matez (Accessed Jan 13, 2025)
- ↑ Matezofficialpage - Facebook (Accessed Jan 13, 2025)
- ↑ https://www.instagram.com/matezofficial/ (Accessed Jan 13, 2025)
- ↑ MATEZ OFFICIAL – Telegram (Accessed Jan 13, 2025)
- ↑ @Matezofficial Twitter (Accessed Jan 13, 2025)
- ↑ @CryptoxJungle Twitter (Accessed Jan 13, 2025)