Poolz encounters arithmetic overflow vulnerability attack, resulting in a loss of nearly $670,000

Recently, an attack on the multi-chain Poolz project has attracted widespread attention in the industry. According to on-chain monitoring data, the attack occurred on March 15, 2023, involving multiple public chains such as Ethereum, BNB Chain, and Polygon.

This attack resulted in a large number of tokens being stolen, including tokens from multiple projects such as MEE, ESNC, DON, ASW, KMON, and POOLZ. Preliminary estimates suggest that the total value of the stolen assets is approximately $665,000. Currently, some of the stolen tokens have been exchanged by the attackers for BNB, but they have not yet been transferred out of the addresses controlled by the attackers.

Analysis shows that this attack primarily exploited an arithmetic overflow vulnerability in the Poolz project's smart contract. The attacker triggered the integer overflow by cleverly constructing input parameters while creating liquidity pools in bulk, thereby achieving the goal of obtaining a large amount of liquidity with a very small number of tokens.

Specifically, the attacker first exchanged a small amount of MNZ tokens on a certain decentralized exchange. Subsequently, the attacker called the CreateMassPools function in the Poolz contract, which allows users to create liquidity pools in bulk and provide initial liquidity. The issue lies in the getArraySum function, which is used to calculate the total amount of initial liquidity provided by the user.

The attacker carefully constructed an array containing extremely large values as input parameters. When these values were summed, integer overflow occurred, resulting in a huge discrepancy between the actual number of tokens transferred and the recorded number. Ultimately, the attacker only transferred 1 token but recorded a massive liquidity value in the contract.

After completing the above operation, the attacker immediately called the withdraw function to extract funds, easily completing the entire attack process.

This incident highlights once again the dangers of arithmetic overflow issues in smart contracts. To mitigate similar risks, industry experts recommend that developers use newer versions of the Solidity programming language, which automatically perform overflow checks during the compilation process. For projects using older versions of Solidity, it may be advisable to incorporate mature security libraries such as OpenZeppelin to address integer overflow issues.

This incident reminds us that contract security is always a key issue that cannot be ignored in the blockchain ecosystem. Project teams need to continuously strengthen code audits and security testing, while users should remain vigilant and carefully assess the associated risks when participating in new projects.