Skyward Finance, a decentralized platform on NEAR protocol, reported a contract exploit that has drained the network and “rendered its Treasury and the $SKYWARD token effectively worthless.”
Users are to note that current and previous token sales are unaffected; Skyward assured the community saying, “If you are hosting or participating in a token sale on Skyward, do not worry: the existing and previous sales are not affected, so funds and proceeds can be withdrawn safely.
The exploit was made through multiple withdrawals within a single transaction. According to Skyward, “the exploiter effectively withdrew wrap.near multiple times within one transaction.” Here is the transaction for further review: explorer.near.org/transactions/9…
Blockchain security firm, BlockSec, said the exploit was worth more than $1M NEAR Tokens. Reporting the exploit, BlockSec said that “the root cause is in the function redeem_skyward, which is used to redeem the treasury from the protocol.”
Additionally, “the function does not check whether the provided token_account_ids are duplicated. In this case, the attacker is able to redeem the treasury tokens multiple times with the same skyward share withdrawn once,” BlockSec said.
Interacting with Skyward was declared out of bounds, and users are urged to make a withdrawal of their “funds safely where they can.”
Skyward’s contracts are locked; therefore, future issues can’t be prevented. “The contracts are fully locked, meaning that no one can pause or prevent future issues with the $SKYWARD token – not even us,” Skyward said.
A rug or not?
There is fear that the exploit might be a rugpull; while this is yet to be confirmed, a user questioned why the exploit wasn’t during the bull season. “I wonder why the exploit didn’t happen during the bull market. Maybe the internal team ran out of money so they plan to do the exploit to start the new project for the next circle,” a user said on Twitter.
Read also;
What do you think of this article? Share your comments below.
