ChainSwap hack — July 2021

ChainSwap ran a cross-chain bridge that minted wrapped versions of partner-project tokens on Ethereum and BNB Chain. An attacker minted and withdrew wrapped tokens belonging to around 16 to 20 partner projects, among them Antimatter, Blank, Corra, Dafi, Nord Finance, Option Room, Oro, Peri, Razor Network, Rocks, Umbrella Network, Unifarm, Unido, Vortex, Wilder World and ChainSwap's own ASAP. Accounts differ on the day. Razor Network, a direct victim, dated the start at about 20:00 UTC on 10 July 2021; ChainSwap titled its own post-mortem 11 July, and SphereX, Crypto Briefing and Lossless all date the incident 11 July.

ChainSwap attributed the loss to a logical flaw in the cross-chain quota code that allowed non-whitelisted addresses to have their transfer quota raised automatically. SphereX's later analysis narrowed it further: signature verification worked, but the proxy routed to an unverified implementation contract deployed about a week earlier, whose authQuotaOf() function granted any address an effectively unlimited quota. The verified code on Etherscan was not the code being run.

The published figures diverge sharply. ChainSwap's post-mortem put the loss at around $4 million. SphereX put it at $4.4 million. Contemporaneous reporting by Crypto Briefing and Lossless used roughly $8 million, closer to the notional pre-crash value of the minted tokens. The scale of the price damage is disputed: Crypto Briefing's worst case was Antimatter's MATTER at 68.8%, while Lossless described a 99% plunge in affected tokens and put ChainSwap's own ASAP at 96.7% below its all-time high.

This was ChainSwap's second breach in nine days; an incident on 2 July cost about $800,000. After 10 July it froze the bridge and shut down nodes, compensated some partner projects — Razor Network confirmed receiving 48,475 USDC against a 121,187 DAI loss — and several projects redeployed their tokens.