TempleDAO, STAX Hacked for $2.3 Million

TempleDAO and its associated project STAX Finance have been hacked for approximately $2.3 million.

TempleDAO and STAX Hacked

TempleDAO and STAX have been exploited.

STAX acknowledged the attack in a maintenance note. It wrote that the attacker managed to steal a total of 321,154 xLP on October 11. Those tokens were swapped for 1.3 million FRAX and 1.4 million TEMPLE. The TEMPLE tokens were then sold for another token, FRAX.

The market value of those tokens places the value of the attack above $2.3 million. PeckShield estimates that 1,831 ETH ($2.34 million) were stolen in the attack.

STAX has urged users not to deposit more funds into its contracts until the problem has been resolved, noting that it has frozen the dApp to provide accidental access.

The project wrote that the issue is “now under control and the exploiter can do no further harm,” adding that “remediations will be made for all affected users.”

STAX added that it is “following up with Binance” on the matter. Presumably, it is working to track or block funds that move through the exchange. Some reports suggest that the attacker initially moved his funds from a Binance account.

Finally, STAX said that it will create a white hat bounty to encourage the return of stolen funds and increase the bounty that it already offers through Hats Finance.

The attack was possible because of improper access control in a staking-related smart contract. The attacker was able to forge another smart contract to call a specific function in that contract and request the movement of funds.

TempleDAO has emphasized the limited scope of the attack, noting that its “vault contracts share no common code with STAX, have been audited by PeckShield, and remain secure.”

TempleDAO is said to have $100 million in stablecoins in those core contracts. Its total value locked also amounts to approximately $56 million at present.

Disclosure: At the time of writing, the author of this piece owned BTC, ETH, and other cryptocurrencies.