SlowMist disclosed a logic flaw in a DoinGud smart contract that allowed an attacker to replay the same transaction data and withdraw funds multiple times. The issue was tied to the contract’s acceptOffer function, where the security firm said protections against duplicate transactions were missing and required state-cleanup checks were not in place. According to the disclosure, the attacker used two replayed transactions to drain all 70,973.871434 USDC held in the contract’s escrow account, ending with a profit of about 35,380 USDC. SlowMist also said the attack was funded with a flash loan, and that the attacker supplied neither any NFT nor any principal of their own. The vulnerable contract address was identified as 0x123aafc8d0a07ce1a146e53aa899e77f21a2dde1, while the attacker address was listed as 0xb8c717239bcace558c3a8dc471c16e07bf57a1eb. The disclosure was cited by Techub News and attributed to @SlowMist_Team.
Techub News reported that blockchain security firm SlowMist disclosed a logic flaw in a DoinGud smart contract.
According to SlowMist, the issue sat in the acceptOffer function. Because the contract lacked protection against duplicate transactions and did not include the necessary state-cleanup checks, an attacker was able to replay the same transaction data and withdraw funds multiple times.
SlowMist said the attacker exploited the flaw with two replayed transactions, draining the entire 70,973.871434 USDC held in the contract’s escrow account and making about 35,380 USDC in profit. The attack capital came from a flash loan, and the attacker provided neither any NFT nor any principal.
The vulnerable contract address was 0x123aafc8d0a07ce1a146e53aa899e77f21a2dde1. The attacker address was 0xb8c717239bcace558c3a8dc471c16e07bf57a1eb.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
