Post-Mortem of PCT Staking Vault Attack

Pinecone launched the PCT staking vault at 09:00 UTC on Aug 18 and was attacked at 11:41:19 UTC

BSC Blockchain: Block 10135652

Transaction hash: 0xe23ffa079edd975b5bd48503757040b7aa60e63d66972419fd56f4404c6d4da1

The Cause of Attack:

PCT token is different from ordinary ERC-20 Token in that it had a built-in burning mechanism. Interaction with smart contracts which often report errors due to incorrect wallet balance and causing transaction failures. In order to avoid this issue, the rollback mechanism which voids the transaction when the wallet balance is insufficient is taken offline. This mechanism, though existed, could not be abused prior to the launch of PCT vault.

When the Pinecone PCT staking vault went online, the restriction for illegal operations were implemented at front-end , however the hacker bypassed the webpage and directly called the smart contract through EOA. In the end the hacker managed to withdraw greater amount of PCT token than the amount he deposited, because the Smart Contract failed to verify the account balance.

Total Loss: around 3.53 mil PCT token

Attacker analysis:

We have identified three wallet address of the attacker and have reason to believe that they belong to the same person. The hacker has participated in the pre-sale of Pinecone through three accounts.

The three accounts are:

0x472a2c88c1a5f794eb80706e587d4a120d9be255

0x430ad7e178d3e00145f35c041c7f486d7e8a4c7e

0xfc6682db7e9f57882e8b18ebc9adc7a19f770494

One of the account has been interacted with a Binance Hot Wallets

0x515b72ed8a97f42c568d6a143232775018f133c8, transactions

Transaction hash

0x6e757a62efe874e89d00b05de16bf5da63fc8fdc95681605813b9670365e13eb

The project team has contacted the Binance team and taken due action to locate the hacker.

Peckshield has offered great help to the project team during the post-mortem analysis and will continue to support the project team for further security audit.

Further compensation plan will be released soon.