Dec 2024 - LABUBU Smart Contract Self-Transfer Vulnerability - $12k (Global)
Labubu is a plush toy brand created by Hong Kong designer Kasing Lung, initially introduced in 2015. The character is part of a series called "The Monsters," which is influenced by Nordic folklore and mythology that Lung enjoyed during his childhood. Labubu, along with other characters like Zimomo and Spooky, gained significant popularity after a collaboration with Pop Mart in 2019, leading to its widespread recognition. In 2024, the toy gained even more attention after Blackpink's Lisa was seen with it, sparking a trend across Southeast and East Asia.
Labubu toys are known for their playful yet mischievous design, featuring a round, furry body, wide eyes, pointed ears, and sharp teeth that create a mischievous smile. The toy's popularity has led to it being produced in various colors and sizes, including plush toys and vinyl figures. The partnership with Pop Mart has been a major success, with "The Monsters" line generating significant sales, amounting to 6.3 billion Chinese yuan ($870 million) in the first half of 2024. Labubu's rise in popularity has caused global "mania," with celebrities and fans flocking to acquire the toy.
"The root cause lies in the flawed logic in handling self-transfers."
'If you use variables to store user balances just ask "what happens when you send tokens to yourself....."'
"Our system has detected a suspicious attack involving #LABUBU on #BSC, resulting in an approximately loss of $11.9K."
Further Analysis
Labubu is a popular plush toy brand created by Hong Kong designer Kasing Lung in 2015 as part of "The Monsters" series, which is inspired by Nordic folklore. Its partnership with Pop Mart in 2019 helped boost its recognition, and in 2024, the toy gained further attention when Blackpink's Lisa was spotted with it, sparking a trend across Southeast and East Asia. Known for its playful yet mischievous design, Labubu has been produced in various forms and sizes. A new token named after Labubu was launched on the Binance Smart Chain. A suspicious attack involving a bug when self-transfering the new token resulted in a loss of approximately $11.9K.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
EVMInk BNBS Contract Remove Liquidity Reentrancy Attack > > < < Clober DEX Unguarded Burn Function Reentrancy
Sources/Further Reading
BNB Smart Chain Transaction Hash (Txhash) Details | BscScan
(Dec 31)
Labubu - Wikipedia (Dec 31)
@Numbers19079000 Twitter (Dec 31)
@TenArmorAlert Twitter (Dec 31)
LABUBU (LABUBU) Token Tracker | BscScan
(Dec 31)
BNB Smart Chain Transaction Hash (Txhash) Details | BscScan
(Dec 31)
Labubuoffcial (Dec 31)
Labubu | Logopedia | Fandom (Dec 31)
@LabubuOfficial Twitter (Dec 31)
BlockThreat - Week 50, 2024 (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|