ABCCAPP

DESCRIPTION OF EVENTS

The ABCCApp smart contract on the Binance Smart Chain appears to provide the ability to claim daily stablecoin rewards. The smart contract was launched on April 1st, 2023.

Unfortunately, the smart contract was launched with a missing access control on a key addFixedDay function, which was instrumental in calculating the claimable amount of the BSCUSD stablecoin.

The technical description provided by TenArmor is as follows:

"The root cause is that the addFixedDay() function lacks access control, and fixedDay is used in the calculation of claimable USDT."

TenArmor reported the loss with an estimated value of $10.1k. While TenArmor reports that the amount is claimable in USDT, it appears that the attack transaction took BSCUSD.

The project does not appear to have a public website or social media presence. The transaction was reported by TenArmor.

It's unclear if there is any outcome. There do not appear to be any mentions of this transaction in any other locations.

There is no suggestion that any funds have been recovered.

There does not appear to be any ongoing attempt to investigate further or recover funds.

Explore This Case Further On Our Wiki

The ABCCApp smart contract on Binance Smart Chain allowed users to claim daily stablecoin rewards but contained a critical vulnerability due to a missing access control on the addFixedDay function. This function was essential in calculating claimable BSCUSD (though TenArmor reports the loss in USDT). The flaw allowed an attacker to manipulate the rewards, leading to an estimated $10.1k loss. The project lacks any public-facing presence, and there is no evidence of recovery efforts, further investigation, or community awareness beyond TenArmor’s report.

TenArmor - "Our system has detected a suspicious attack involving #ABCCApp on #BSC, resulting in an approximately loss of $10.1K. The root cause is that the addFixedDay() function lacks access control, and fixedDay is used in the calculation of claimable USDT." - Twitter/X (Aug 27)
Attack Transaction - BSCScan (Aug 27)
ABCCScan Exploiter Address - BSCScan (Aug 27)
The Exploited Smart Contract - BSCScan (Aug 27)
The Exploited Contract Creation Transaction - BSCScan (Aug 27)

More case studies

Equilibria Finance Reward
Mechanism stk-ePendle Balance Hack

HMS HMagician Smart Contract
Burn Mechanism Exploited