SlowMist said the MUSystem contract was exploited because of a flaw in how its deposit() and withdraw() functions handled first-time deposit rewards and ETH refunds, leading to losses of about $36,900. According to the security team’s post on X, the deposit() function counted the first deposit bonus in both the instant ETH refund and the user’s MUS allocation. At the same time, the withdraw() function allowed redemption within the same transaction and did not cap returned ETH at the original deposit amount. SlowMist said the attacker used 16 newly created addresses to repeat the cycle and extract ETH from the contract. The attacker address was identified as 0x1a083ADf234a8f67ad65A9B9B616853ACf5998E5, while the affected contract address was 0x9bdf81e6066d32764b7e75a1b5577237e06d9364.
Techub News reported that @SlowMist_Team said on X that the MUSystem contract was exploited, with losses of about $36,900.
How the flaw worked
According to SlowMist, the root cause was in the deposit() function, which counted the first deposit reward in both the instant ETH refund and the user’s MUS allocation. The withdraw() function also allowed redemption within the same transaction and did not limit the total ETH returned to no more than the deposited amount.
SlowMist said the attacker used 16 new addresses to repeat the cycle and extract ETH.
Addresses involved
The attacker address was 0x1a083ADf234a8f67ad65A9B9B616853ACf5998E5. The affected contract address was 0x9bdf81e6066d32764b7e75a1b5577237e06d9364.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
