Poolz suffers a security breach, with digital asset losses of approximately $665,000.

Recently, a security incident involving multi-chain assets has attracted industry attention. According to on-chain data monitoring, around 3:16 AM UTC on March 15, 2023, the Poolz project on Ethereum, BNB Chain, and Polygon network was attacked. This incident involved multiple tokens, including MEE, ESNC, DON, ASW, KMON, and POOLZ, with a total of approximately $665,000 in assets affected.

The attacker leveraged a vulnerability in the smart contract to execute a series of operations. First, a certain amount of MNZ tokens was exchanged on a decentralized exchange, and then the CreateMassPools function was called. This function was intended for the bulk creation of liquidity pools and to provide initial liquidity, but the getArraySum function contained a risk of arithmetic overflow.

Specifically, the attacker carefully constructs parameters such that the sum of the elements in the _StartAmount array exceeds the representable range of the uint256 type. This causes the accumulation result to overflow to 1, while the contract still records the pool attributes according to the original _StartAmount value. Therefore, the attacker only needs to transfer 1 token to record a large amount of false liquidity in the system.

Finally, the attacker completed the entire attack process by calling the withdraw function to extract funds. Currently, some of the stolen assets have been exchanged for BNB, but have not yet been transferred out of the attacker's address.

This incident once again highlights the importance of smart contract security. To prevent similar issues, it is recommended that developers use a newer version of the Solidity compiler, which includes built-in overflow checks. For earlier versions, it is also advisable to consider incorporating third-party security libraries such as OpenZeppelin to enhance code security.

This event reminds us that in the rapidly developing blockchain field, security should always be the primary consideration. Project teams need to pay more attention to code audits and vulnerability testing, while users should also increase their risk awareness and participate cautiously in emerging projects. Only by building a healthier and safer ecosystem can we promote the sustainable development of the entire industry.