Harvest Keeper

Insider Manipulation

Estimated loss

$933.0K

VERDICT —OUT OF SCOPE

Root cause is social engineering — privileged personnel deceived into authorizing the drain. Contract behaved as written. Defense lives in process controls (multi-party approval, M-of-N signoff windows), not in smart-contract review.

▰ METHOD

SOCIAL ENGINEERING

SOCIAL-ENGINEERING

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

According to news, the Harvest_Keeper project maliciously transferred user funds, involving an amount of about 933,000 US dollars. Through the data on the chain, it was found that the attacker used the owner authority to transfer the USDT pledged by the user in the HarvestKeeper contract by calling the getAmount function, and then the attacker used the user's token authorization to the EOA account to transfer the user's funds through the EOA multiple times. Attack method (per SlowMist): Insider Manipulation. Reported loss: $ 933,000.

Primary source

https://www.panewslab.com/zh/sqarticledetails/7urkn6lh.html ↗

Sourced from

slowmist

Technical record