Reproduction of the WEGLD hack (2022/06/06)

On 2022/06/06, a hacker stole 1.650M EGLD from the WEGLD smart contracts (450,000 EGLD on shard 0, 800,000 EGLD on shard 1, 400,000 EGLD on shard 2). This hack has been fixed by the Elrond team.

With this repository, you will be able to reproduce exactly what the hacker did to steal the EGLD (using his smart contract code).

Thanks to this reproduction, we understood how the exploit was possible. If you want to understand the exploit too, go check the explanation repository.

Repository overview

This repository contains the following files:

• hacker.wasm: the compiled code of the smart contract used by the hacker (available here)
• hacker.wat: the decompiled code of the smart contract used by the hacker (decompiled with this tool)
• wrapper.wasm: the compiled code of the WEGLD smart contract (available here)
• wrapper.wat: the decompiled code of the WEGLD smart contract (decompiled with this tool)
• mandos/hack.scen.json: a scenario that reproduces the hack on a version of the Elrond network running on your computer. You can see that at the end of the scenario, the hacker has successfully withdrawn 800,000 EGLD from the WEGLD smart contract.

Reproduction

Here is how to reproduce the hack:

1. Install erdpy (cf. tutorial)
2. Clone this repository
3. Open a terminal in the repository directory
4. Run the hack scenario: erdpy contract test

The scenario in mandos/hack.scen.json should succeed. You can see that at the end of the scenario, the hacker has successfully withdrawn 800,000 EGLD from the WEGLD smart contract.