On October 31, 2023, Unibot, a trading bot service, faced a severe security breach, resulting in a loss of at least $640k from users who had approved the contract. The exploit targeted the trading bot's newly deployed router contract, stealing funds from users who had previously approved it.
Behind the Breach
The new router contract, deployed just a day before the exploit and remaining unverified on Etherscan, contained a critical vulnerability. It allowed attackers to insert a
transferFrom() call, enabling them to drain approved tokens directly from Unibot user wallets. Users who had approved the new router to spend tokens were potential victims.
Despite the Unibot team's action to halt the router and mitigate the issue, opportunistic attackers seized the moment. They deployed cloned exploit contracts and continued to drain funds, exploiting users with existing approvals to the new router contract.
The Wider Picture
While the original exploiter sent 355 ETH (equivalent to $640k) of profits to Tornado Cash, other malicious actors continued to deploy contracts to replicate the exploit. This incident is eerily similar to an attack on Maestro, another trading bot, which lost around $500k just a week prior. Unlike Maestro, which responded quickly and even refunded users more than their losses, Unibot's response seemed to diminish the risk, potentially leading to further losses.
Lessons from the Incident
In conclusion, the recent Unibot exploit serves as a critical reminder of the inherent risks in decentralized finance, particularly when it comes to trusting closed-source contracts. Engaging with unaudited and not battle-tested contracts poses a significant risk, as this incident demonstrates.
You build the future. We help you secure it.