Poolz encounters a security incident, approximately $665,000 in assets affected

Recently, multiple Poolz projects on various blockchain networks encountered security incidents, leading to the illegal extraction of a large number of tokens. The incident occurred around 3:16 AM UTC on March 15, 2023, affecting several networks including Ethereum, BNB Smart Chain, and Polygon.

According to on-chain data, this incident involves multiple tokens, including MEE, ESNC, DON, ASW, KMON, POOLZ, etc. The total value of the tokens extracted is approximately $665,000. Currently, some of the extracted tokens have been exchanged for BNB, but have not yet been transferred to other addresses.

Analysis shows that the root cause of this incident is the arithmetic overflow vulnerability in the smart contract. The attacker cleverly exploited the vulnerability in the CreateMassPools function to perform low-cost large-scale withdrawal operations. Specifically, when creating the liquidity pool, the attacker took advantage of the integer overflow issue in the getArraySum function, resulting in the amount recorded by the system being much greater than the actual deposit.

The event process is roughly as follows:

1. The attacker first exchanged a small amount of MNZ tokens through a decentralized exchange.

2. Then the CreateMassPools function was called, which allows users to create liquidity pools in bulk and provide initial liquidity.

3. When creating the pool, the attacker cleverly crafted the input parameters so that the return value of the getArraySum function became very small due to overflow, while the actual recorded deposit amount was a very large number.

4. Finally, the attacker withdrew tokens far exceeding the actual amount deposited through the withdraw function.

To prevent similar incidents from occurring again, industry experts recommend that developers take the following measures:

1. Use a newer version of the Solidity programming language, which has built-in overflow checking mechanisms.

2. For projects using older versions of Solidity, it may be worth considering the introduction of OpenZeppelin's SafeMath library to handle integer operations and avoid overflow issues.

3. Strengthen code audits, paying special attention to parts that may lead to arithmetic overflow.

4. Consider introducing additional security mechanisms such as multi-signature to add a layer of protection for critical operations.

This event serves as a reminder to blockchain project developers and users that security should always be the top consideration in the rapidly evolving cryptocurrency ecosystem. Project teams should continuously improve security measures, while users should remain vigilant and participate cautiously in various DeFi activities.