A NullMeridian record Andromeda Logs

NullMeridianLog

28 Feb 2024

Seneca Chamber: performOperations Allowed Arbitrary transferFrom

Seneca: on 28 Feb 2024 Chamber.performOperations let an attacker call transferFrom using users' excessive approvals. $6.4M stolen; ~$5.3M recovered via whitehat, ~$1.04M kept as bounty.

  • Event date
  • Incident typeSmart-contract exploit
  • Bug classAccess control
  • Published

Loss, as sourced

$6.4m stolen; ~80% (~$5.3m) recovered through a whitehat request with ~20% (~$1.04m) kept as bounty, per Seneca. Breach targeted wallet approvals, not funds deposited into Seneca TVL/staking.

Traceability

Primary sources

  1. 01paragraph.comSeneca Exploit Post-Mortem (opens in a new tab)

In brief

Root cause: Per Seneca: Chamber.sol performOperations allowed calls into other contracts; attacker directed transferFrom to pull approved tokens to their address. Contract had been audited by Halborn.

Timeline, as sourced: Per Seneca: Wednesday 28 Feb attack; whitehat recovery of ~80%; post-mortem follows.

Account, as sourced

Claimed (Seneca) (post-mortem (opens in a new tab)): funds directly deposited into Seneca (TVL + staking) unaffected; wallet approvals were the target.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/seneca-chamber-performoperations-2024