Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

88mph had an initialization function without the onlyOwner() modifier. Additionally, there was no check to ensure that a contact wasn't double initialized. Three of the pool contracts were vulnerable to this.

This means that ANYBODY could have became the owner of the contract. Using this, an attacker could steal other users NFTs and deposits as well as call mint() and burn() to add value to themselves.

To do fix this bug, they had to steal all of the funds, upgrade the contract then fix the money back. Yikes... I hate this world. Regardless, a very simple access control bug from an apparently unaudited contract.