wxBTRFLY
Hack or exploit on Jan 16, 2022 · Contract Vulnerability
What happened
White hat hackers at @immunefi discovered a critical vulnerability in the wxBTRFLY Token contract. The transferFrom function in the contract did not update the recipient's authorization correctly, and would incorrectly update the msg.sender's authorization. Although the vulnerability itself is serious, the cause is not complicated (more like a clerical error produced by the developer). What is more interesting is the official repair method. Since the contract itself does not support upgrade, the contract code cannot be updated directly; the contract does not support suspension, so it is not possible to transfer user assets by means of snapshot + migration. The final official measure was to launch an attack transaction by itself, transferring the assets of all users affected by the vulnerability to a multi-signature wallet.
Details
- Date
- Jan 16, 2022
- Kind
- Hack or exploit
- Method
- Contract Vulnerability
- How in
- Smart contract bug
- Target
- not stated
- Chains
- Ethereum
Reported by
Related incidents
MEV Bots 2022 · Hack or exploit · $1.5M
Bitkeep Swap 2022 · Hack or exploit · $1.2M
Dogechain 2022 · Hack or exploit · $600K
Marvin Inu 2022 · Hack or exploit · $328K
SwanBluechip, "wxBTRFLY hack, Jan 16, 2022: undisclosed lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htf1030205cc/ (data as of 2026-11-01).