An attacker exploited an integer type conversion flaw in the DripsNetwork DaiDripsHub contract, draining 24,882 DAI from the DaiReserve. The vulnerability allowed a negative value to flip the transfer direction, resulting in the theft.
The `give(address,uint128)` function converted `uint128 amt` to `int128` without validating that `amt <= type(int128).max`. By passing `2^128 - reserveBalance`, the conversion produced a negative value, which then became positive after negation, reversing the intended deposit into a withdrawal and draining DAI.
24,882 DAI stolen from the DaiReserve contract; attacker address 0x84da7a5e2315eb798f04b75554aeb15047269cce; victim contract 0xf9bbb2df44c…
Today we notified @dripsnetwork about an exploit involving an old DaiDripsHub contract. An attacker exploited a signed-integer cast vulnerability which resulted in $24,882 loss. Specifically the _give function calls _transfer(user, -int128(amt)), intending a …
🚨SlowMist TI Alert🚨 💸 @dripsnetwork Loss: 24,882.99 DAI 🔍 Root Cause: Integer type conversion flaw in `DaiDripsHub`'s `give(address,uint128)` function. The function converts `uint128 amt` to `int128` without validating `amt <= type(int128).max`. Attackers…
1 related posts from @exvulsec
