Jan 2025 - FortuneWheel swapProfitFees Access Control Issue - $22k (Global)
FortuneWheel is an "old unknown project contract" on the Binance Smart Chain which was created in June 2023.
"The root cause is the swapProfitFees() function which will add BNB to a swap and attack could gain from the K change."
"“swapProfitFees” function exchanges tokens using pancakeswap and has no [access] modifier."
"this is a classic case of price manipulation. The swapProfitFees() function lacks slippage protection and is easily manipulated by a swap."
"Hacker exchanged a huge amount of WBNB to LINK, then called this function, exchanged LINK to WBNB again. He gained almost $21k."
Further Analysis
FortuneWheel is a project on the Binance Smart Chain launched in June 2023, identified as an "old unknown project contract." The vulnerability lies in its "swapProfitFees()" function, which facilitates token exchanges using PancakeSwap but lacks an access modifier and slippage protection, making it vulnerable to manipulation. A hacker exploited this weakness by swapping a large amount of WBNB for LINK, then using the function to swap LINK back to WBNB, ultimately making a profit of nearly $21,000 through price manipulation.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
SuperVerse Fraudulent Airdrop Twitter/X Compromise > > < < Usual Money USD0++ Depegging When Backing Removed
Sources/Further Reading
FortuneWheel Smart Contract Exploited (Dec 31)
@TikkalaResearch Twitter (Dec 31)
@0xNickLFranklin Twitter (Dec 31)
Sandwich attack! – Defi hack analysis (Dec 31)
FortuneWheel Smart Contract Creation (Dec 31)
@TenArmorAlert Twitter (Dec 31)
@ACai_sec Twitter (Dec 31)
20250110-FortuneWheel 攻击事件：竟然不设滑点，那就体验一下 Force Investment 吧 - ACai_sec - 博客园 (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|