ORB token loses $32.000 in reentrancy attack

The ORB token has been hit by a cyberattack in which attackers managed to steal approximately $32.610. Security firm SlowMist identified a reentrancy vulnerability in the ORBCore contract that allowed attackers to sell tokens tax-free and manipulate the liquidity pool.

In brief:

• Attackers used a reentrancy flaw to steal approximately $32.600 in ORB tokens
• The ORBCore contract could sell tokens tax-free, which is normally not allowed
• The attack took place through manipulation of liquidity reserves on PancakeSwap

How the attack happened

The ORBCore contract acted as a kind of whitelisted entity for ORBToken, meaning it could sell tokens without the usual 5% burn tax. Attackers found a way to use this mechanism against the system.

The attackers started a cycle via the receive() function of the ORBToken contract. This automatically gave them maximum allowance to move tokens and triggered an external call to the addPoolAndSell function of ORBCore. However, this contract lacked a reentrancy guard, a security measure that prevents repeated calls.

Due to this weakness, the attackers could create an infinite loop in which they repeatedly sold tokens tax-free. They then used the burnLP function to burn a large portion of the ORB tokens in the liquidity pool, and finally called sync() to manipulate the reserve balances and make a profit.

Identified addresses

SlowMist identified the attack address (0xd8b49172b1a33e77c2619a78e08471facff5dad3) and the attack contract (0x4f33733a40fae6c19c3a4faf9bc08ce9a1806831). The vulnerable contracts were the ORBToken contract, the ORBCore contract and the PancakeSwap trading pairs to which the pools were linked.