Hacker turns 25 cents into 46 billion fake Bitcoins to steal $770,000 — Symbiosis DeFi exchange bit by lack of basic bounds checking in smart contract

In September, a hacker exploited a vulnerability in the Symbiosis DeFi exchange, transforming a mere 25 cents into an astounding 46 billion fake Bitcoins, ultimately siphoning off $770,000 worth of the cryptocurrency. The exchange, which has been operating for five years, facilitates trading across various crypto pairs by utilizing smart contracts - self-executing code hosted on the blockchain.

While this decentralized approach is logical, it also creates an accountability issue, as demonstrated by the hack. The flaw lay in the exchange's lack of adequate bounds checking in its smart contract code - specifically, the failure to verify if a transaction fee was a positive number. This oversight allowed the hacker, who had assumed the role of a network administrator, to manipulate transaction fees, effectively adding to the amount instead of deducting it.

By issuing 12 transactions with a negative fee, the thief managed to generate an astronomical 46 billion syBTC tokens, which were tradable on the Symbiosis network. Despite the hacker converting around $336,000 into cash via Uniswap, the remaining tokens were blocked by security firms and exchanges, making it challenging for the hacker to utilize them.

The victims, however, remain at the mercy of the hacker, who has promised to repay the debts, either by returning the tokens or through a legal process. DeFi pools, like Symbiosis, function as automated trading pots, running on blockchain networks such as Ethereum or Solana, and enabling direct trading against the funds in the pool without any third-party involvement.

The hacker's actions underscore the importance of rigorous code testing and the potential risks associated with seemingly minor oversights in complex codebases.