SpookySwap

Malicious Code Injection Attack

Estimated loss

$5.0K

VERDICT —UNRATED

Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.

▰ METHOD

Undisclosed

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

DEX SpookySwap on Fantom tweeted that the team is investigating a frontend vulnerability on their domain. Please do not execute any transactions on the DEX. On November 19, Spooky updated that a 3rd party JavaScript plugin enabled code injection from npm packages. This enabled replacing the spooky router contract on the Spooky Fi frontend with a malicious contract which sent funds that users attempted to swap to the exploiter. Attack method (per SlowMist): Malicious Code Injection Attack. Reported loss: $ 5,000.

Primary source

https://twitter.com/SpookySwap/status/1725677274718994543 ↗

Sourced from

slowmist

Technical record