OMNI404 token loses 2.4 WETH due to critical bug

Security firm SlowMist has discovered a critical bug in the OMNI404 contract that led to a loss of 2.4 WETH. The attacker exploited a design flaw in the transfer function that made it possible to receive more tokens than intended.

In brief:

• OMNI404 loses 2.4 WETH due to a design flaw in the transfer function
• Attacker exploited the discrepancy between ERC20 and ERC721 operations
• A flash loan was used to carry out the exploit

How the attacker exploited the bug

The OMNI404 contract treats transfer values of 50 or less as ERC721 token IDs, but always also transfers a fixed amount of 1e18 OMNI404 units. This created a gap in the contract’s logic.

Uniswap V3 used exact-output swaps in which the contract repeatedly called the transfer function with low values. The pool only accounted for minimal amounts in wei, while the attacker received full 1e18 OMNI404 units every time. By systematically exploiting this discrepancy and deploying flash loans, the attacker was able to make a profit without having to put up any capital.

Details of the attack

The attacker’s address 0xfb26db4eab18cb50d29ff431888dd643a7e9c9f8 targeted the Uniswap V3 liquidity pool at address 0xb3f613b9bc84ddb29d78fa4685b01d98412bba0b. The vulnerable OMNI404 contract is at 0xd5c02bb3e40494d4674778306da43a56138a383e.

The bug lay in the way the contract calculated NFT mint and burn amounts. This was done solely on the basis of the difference between the ERC20 balance before and after the transfer, which proved inadequate when transfers were interpreted as ERC721 token IDs.