Poolz protocol encounters arithmetic overflow attack, resulting in a loss of approximately $665,000

Recently, an attack on the Poolz protocol has attracted industry attention. According to on-chain data, the attack occurred on March 15, 2023, involving multiple networks such as Ethereum, BNB Chain, and Polygon. The attacker successfully exploited an arithmetic overflow vulnerability in the smart contract, stealing a large amount of tokens worth approximately $665,000.

The attacker mainly targeted the CreateMassPools function of the Poolz protocol. This function was originally intended to allow users to create liquidity pools in bulk and provide initial liquidity. However, due to an arithmetic overflow issue in the getArraySum function, the attacker was able to exploit this vulnerability.

Specifically, the attacker passes in a specific _StartAmount array that causes the cumulative result to exceed the maximum value of uint256, resulting in an overflow where the return value is 1. This allows the attacker to record a deposit amount far exceeding the actual amount in the system by transferring just 1 token. Subsequently, the attacker can use the withdraw function to extract these non-existent tokens.

This incident involves multiple tokens, including MEE, ESNC, DON, ASW, KMON, POOLZ, etc. The attacker has exchanged some of the profited tokens for BNB, but as of the time of reporting, these funds have not yet been transferred out of the attacker's address.

To prevent similar issues from occurring again, industry experts recommend that developers take the following measures:

1. Use a newer version of the Solidity compiler, which automatically performs overflow checks during the compilation process.

2. For projects using lower versions of Solidity, consider introducing OpenZeppelin's SafeMath library to address integer overflow issues.

3. Strengthen code auditing, with particular attention to functions and operations that may cause arithmetic overflow.

4. Conduct regular security assessments and vulnerability scans, and promptly fix any identified issues.

This incident serves as a reminder to blockchain project developers and users that security should always be the primary consideration in the rapidly evolving cryptocurrency ecosystem. For investors, it is also important to remain vigilant and pay attention to the security and technical strength of the projects.