Pandora Spirit

Threat actors in the cryptocurrency space have been increasingly active in recent years in exploiting its flaws to execute their malicious intentions, further stressing the importance of cybersecurity in this fast-growing industry.
<img src="https://miro.medium.com/max/875/1*CgleegmLAl6C5drB30jgWg.jpeg">
<h2 id="header-0">A Snapshot of Cryptocurrency Cyber Threats in 2022</h2>
According to <a href="https://blog.chainalysis.com/reports/2022-biggest-year-ever-for-crypto-hacking/" rel="noopener noreferrer nofollow">Chainalysis</a>, the number of cryptocurrency hacks increased significantly last year, breaking all previous records. With $3.8 billion stolen from cryptocurrency businesses, the damage was up around 15% compared to 2021.
<img src="https://miro.medium.com/max/875/0*qSVfoXM7bWH9fnf7">
<h3 id="source-a-href-https-blog-chainalysis-com-reports-2022-biggest-year-ever-for-crypto-hacking-rel-noopener-noreferrer-nofollow-chainalysis-a">Source: <a href="https://blog.chainalysis.com/reports/2022-biggest-year-ever-for-crypto-hacking/" rel="noopener noreferrer nofollow">Chainalysis</a></h3>
As crypto and other Web3 innovations are becoming more prevalent than ever, cybercriminals are quickly taking advantage of these technologies’ vulnerabilities and unsecured areas. It is important for both users and project developers to be well aware of the risks and take the necessary measures to protect themselves against cyber threats.
<a href="https://bit.ly/3jvaoCv" rel="noopener noreferrer nofollow">Pandora</a> is dedicated to enhancing the safety of our digital world, and we’d like to share a case study that’s essential in protecting against cyber threats.
<h2 id="header-1">Case Study: Pandora NFT Securities’ Smart Contract Vulnerabilities</h2>
Through Pandora’s <a href="https://docs.pandora.digital/pandora/project-overview/bug-bounty" rel="noopener noreferrer nofollow">Bug Bounty Program</a> in cooperation with HackenProof, a white hat hacker reported a vulnerability in <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">Pandora’s NFT Security</a> smart contracts, which could lead an attacker with a valid <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Security</a> on the platform to drain the entire funds being used to pay fixed interest to <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Security </a>holders by calling the functionality <a href="https://hackenproof.com/redirect?url=https://github.com/pandoradigital/smart-contract/blob/master/contracts/0.8.x/contracts/bond/BondRouter.sol#l210-l227" rel="noopener noreferrer nofollow">BondRouter:harvest</a> with crafted parameters.
To exploit this vulnerability, the attacker must have a valid <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Security</a>, then he can call the harvest function on the BondRouter with an array of identical <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Security</a> IDs, containing his own NFT Security ID.
The executeHarvest function will calculate the interest amount first and update the lastHarvest time of the NFT Security out of the for loop, meaning that the attacker can reuse his NFT Security ID and increase the interest amount which will be sent to him via the payment function.
<h2 id="header-2">Validation Steps</h2>
In a real scenario, the attacker must execute the following steps:
1. <a href="https://invest.pandora.digital/investment" rel="noopener noreferrer nofollow">Mint</a> a new <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Security</a>
2. Wait until the interest amount is available for claim on invest.pandora.digital (in the case of <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Security</a>, it pays interest every second, so the attacker can steal funds immediately after his purchase of a valid NFT Security).
3. Call the BondRouter:harvest function by supplying a specially crafted payload on the info parameter
4. This payload must be:
A ClaimInfo array object containing the following things:
<ul>
 <li>1. A valid batchId</li>
 <li>2. An array containing its own NFT Security ID multiples times, for example: [1,1,1,1,1,1,1,1,1,1,1,1,1]</li>
</ul>
5. When the function finishes its execution, the funds will be stolen by supplying just one <a href="https://bit.ly/3C37uev" rel="noopener noreferrer nofollow">NFT Security</a>.
<h2 id="header-3">How We Fixed This Issue</h2>
Upon notification of the issue, the team wasted no time addressing the situation and swiftly resolved it.
The key fixes are as follows:
<img src="https://miro.medium.com/max/875/0*jWWMxP7RfqtyHxkP">
These two code blocks are similar in structure, but there is one key difference. In the first code block, the _updateLastHarvest function is called once after all iterations of the loop, while in the second code block, the _updateLastHarvest function is called after every iteration of the loop.
The difference lies in the timing of the _updateLastHarvest function. In the first code block, it is called after all of the interest amounts have been calculated and added up, whereas, in the second code block, it is called after each individual interest amount has been calculated. This would have an impact on the behavior of the code, as the timing of the _updateLastHarvest function would affect the state of the smart contract.
<h2 id="header-4">Be Rewarded up to $50K for Discovering &amp; Reporting Bugs with Pandora Bug Bounty Program</h2>
The abovementioned vulnerability was submitted to Pandora through our ongoing <a href="https://docs.pandora.digital/pandora/project-overview/bug-bounty" rel="noopener noreferrer nofollow">Bug Bounty Program</a>, which we launched together with our esteemed partner Hackenproof. We extend sincere appreciation and financial compensation — $3,000 in this particular case — to the hacker who offered his valuable contribution towards improving the Pandora ecosystem.
Pandora looks forward to receiving additional bug detection reports from talented security researchers in the future. As part of its concerted efforts to foster cybersecurity, improve its ecosystem, and give bug reporters the recognition and rewards they merit, Pandora offers up to $50K in rewards per critical vulnerability reported.
<h2 id="header-5">NFT Securities — A Reliable, Fixed-Yield Investment in the Bear Market</h2>
After the <a href="https://bit.ly/3I0vF0Y" rel="noopener noreferrer nofollow">Pandora</a> team has been notified of this vulnerability and resolved it in a timely manner, <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Securities</a> continue to impose no further risks to users and maintain their title as one of the most secure yet profitable investments that Pandora has to offer.
<a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">Pandora NFT Securities</a> provide several key advantages that make them an attractive investment, from instant interest payment and principal protection to portfolio diversification, to name a few.
<a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Securities</a> provide a powerful financial solution, fusing the stability and predictability of traditional bonds with cutting-edge blockchain technology. Investors can rely on this new type of asset to protect their investments and guard against price volatility and inflationary pressure.
Learn more about <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Securities</a> in our article: “<a href="https://news.pandora.digital/9-reasons-why-pandora-nft-securities-are-the-perfect-investment-in-a-bear-market/" rel="noopener noreferrer nofollow">9 Reasons Why NFT Securities are the Perfect Invesment in a Bear Market</a>”.
<h2 id="header-6">Final Thoughts</h2>
We are glad to quickly fix this issue and help prevent such potential damage to <a href="https://bit.ly/3I2Z4aG" rel="noopener noreferrer nofollow">NFT Securities’</a> adopters so their investments can be protected at the highest level. Pandora will continue to strengthen cyber security and practices to build a safer platform for all users.
These materials are for general information purposes only. They are not investment advice, a recommendation, or solicitation to buy, sell, or hold any digital asset or engage in any specific trading strategy. Some crypto products and markets are unregulated, and you may not be protected by government compensation and/or regulatory protection schemes. The unpredictable nature of the crypto asset markets can lead to loss of funds. Tax may be payable on any return and/or on any increase in the value of your crypto assets, and you should seek independent advice on your taxation position.
<blockquote>Sustain your finances with Pandora — your favourite DeFi companion!*Telegram Group DEX: <a href="https://t.me/PandoraCommunity" rel="noopener noreferrer nofollow">https://t.me/PandoraCommunity</a>*Telegram Channel DEX: <a href="https://t.me/PandoraDigitalNews" rel="noopener noreferrer nofollow">https://t.me/PandoraDigitalNews</a>*Telegram Group Launchpad: <a href="https://t.me/Pandora_IDO" rel="noopener noreferrer nofollow">https://t.me/Pandora_IDO</a>*Telegram Channel Lauchpad: <a href="https://t.me/PandoraIDO" rel="noopener noreferrer nofollow">https://t.me/PandoraIDO</a>*Twitter: <a href="https://twitter.com/Pandora_DEX" rel="noopener noreferrer nofollow">https://twitter.com/Pandora_DEX</a>*Facebook: <a href="https://www.facebook.com/PandoraDigital.DEX/" rel="noopener noreferrer nofollow">https://www.facebook.com/PandoraDigital.DEX/</a>*Instagram: <a href="https://www.instagram.com/pandora_dex/" rel="noopener noreferrer nofollow">https://www.instagram.com/pandora_dex/</a>*Medium: <a href="https://medium.com/@pandora_digital" rel="noopener noreferrer nofollow">https://medium.com/@pandora_digital</a>*Discord: <a href="https://discord.gg/z7mpcJFfqG" rel="noopener noreferrer nofollow">https://discord.gg/z7mpcJFfqG</a>*Reddit: <a href="https://www.reddit.com/r/pandoradigital/" rel="noopener noreferrer nofollow">https://www.reddit.com/r/pandoradigital/</a>*Blog: <a href="https://news.pandora.digital/" rel="noopener noreferrer nofollow">https://news.pandora.digital/</a>*Partnership: <a href="https://partner.pandora.digital/" rel="noopener noreferrer nofollow">https://partner.pandora.digital/</a>*Official Dapp: <a href="https://bit.ly/3z8azHT" rel="noopener noreferrer nofollow">https://pandora.digital/</a>***Beware of fake accounts impersonating pandora.digital. We will NEVER text you first and ask for your private keys or individual information.
</blockquote>

NFT Smart Contract Bugs & Exploits: A Pandora NFT Securities’ Case Study

Table of Contents

Pandora

Other articles published on Feb 14, 2023

Join our free newsletter for daily crypto updates!