Bonfire token loses $50k due to security flaw in router

The security firm SlowMist has discovered a critical security flaw in the BonfireSwap router that allows attackers to drain more than $50.000 worth of Bonfire tokens from unsuspecting users. The vulnerability has already been successfully exploited.

In brief:

• A security flaw in the BonfireSwap router allows attackers to steal tokens from other users
• 41 Bonfire token holders were affected, including one victim who lost nearly 5,300 tokens
• The flaw lies in the absence of checks in the router’s transfer function

How the attack worked

The vulnerability involved a lack of access control in the transfer function of the BonfireSwap router. The function did not check whether the sender was in fact the owner of the tokens or had permission to send them.

This allowed attackers to designate arbitrary users as the sender of a transaction. The attacker designated himself as the recipient and had the router transfer the victim’s tokens to his own address. This worked because many users had already granted the router permission to manage their tokens, which made the theft possible through already approved transactions.

Details of the attack

According to SlowMist, the attacker used the address 0x2b5bf7d9d9dc1eec68f40c6b7a8f197e65f9731a and an associated attack contract at 0x28E976Ea7b83553d6D1D45CE81334156A2632127. The largest victim lost more than 5,289 tokens in a single transaction.

In total, 41 token holders were affected who had previously granted permission to the vulnerable contract at 0x17e801e17cefc6334059189c178d4783830e03d3. This pattern of routers with security holes has occurred before in the ecosystem, as has an earlier attack in which hackers stole $773 million via a Gnosis Safe router bug.