Analyse des DAOMaker-Angriffs

Analyse des DAOMaker-Angriffs

Angriffsanalyse

Die Transaktion des Angriffs:

0x26aa86261c834e837f6be93b2d589724ed5ae644bc8f4b8af2207e6bd70828f9

Der Angriff Smart Contract ist Open Source.

Schritt 1: 0x054e sendet eine Transaktion, um die Administratorrolle an 0x0eba der Wallet (0x41b8) zu vergeben.

Dann vergibt 0x0eba die Rolle „DAO-Verträge“ an 0x1c93.

Schließlich ruft 0x1c93 (XXX) die Funktion withdrawFromUser auf, um das Geld auf den XXX-Vertrag zu übertragen.

Interessant, dass das Opfer 0x41b8 von 0x054e erstellt wurde.

Zusammenfassung

Zusammenfassend lässt sich sagen, dass 0x054e die Opfer-Wallet 0x41b8 erstellt. Anschließend vergibt 0x054e die Administratorrolle an 0x0eba, der wiederum die Rolle „DAO-Verträge“ an 0x1c93 vergibt. Zuletzt zieht 0x1c93 das Geld vom Opfer ab.

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

During the week of February 9 to February 15, 2026, three blockchain security incidents were reported with total losses of ~$657K. All incidents occurred on the BNB Smart Chain and involved flawed business logic in DeFi token contracts. The primary causes included an unchecked balance withdrawal from an intermediary contract that allowed donation-based inflation of a liquidity addition targeted by a sandwich attack, a post-swap deflationary clawback that returned sold tokens to the caller while draining pool reserves to create a repeatable price-manipulation primitive, and a token transfer override that burned tokens directly from a Uniswap V2 pair's balance and force-synced reserves within the same transaction to artificially inflate the token price.

Top 10 "Awesome" Security Incidents in 2025

Top 10 "Awesome" Security Incidents in 2025

To help the community learn from what happened, BlockSec selected ten incidents that stood out most this year. These cases were chosen not only for the scale of loss, but also for the distinct techniques involved, the unexpected twists in execution, and the new or underexplored attack surfaces they revealed.

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

On August 29, 2025, Panoptic disclosed a Cantina bounty finding and confirmed that, with support from Cantina and Seal911, it executed a rescue operation on August 25 to secure roughly $400K in funds. The issue stemmed from a flaw in Panoptic’s position fingerprint calculation algorithm, which could have enabled incorrect position identification and downstream fund risk.