Skyward Finance hack — November 2022

On 1 November 2022 the treasury of Skyward Finance, a token-sale platform on NEAR Protocol, was emptied in a single transaction. Skyward said the "Skyward Treasury has been drained through a contract exploit" and that current and previous token sales were unaffected.

The flaw was in the treasury's redemption path. The redeem_skyward() function took a list of token account IDs and paid out the caller's proportional share for each entry, but never checked that list for duplicates. BlockSec, whose analysis The Block cited, and a separate breakdown by BlockAudit both describe the attacker supplying the wrap.near identifier repeatedly inside the token_account_ids parameter in one call, so the same wNEAR payout was collected many times over in a single transaction. The treasury contract was publicly callable, so no privileged access was needed.

The exploit transaction is 92Gq7zehKPwSSnpoZ7LGGtSmgmBb4wP2XNDVJqUZRGqz, sent by account 5ebc5ecca14a44175464d0e6a7d3b2a6890229cd5f19cfb29ce8b1651fd58d39 to skyward.near, calling redeem_skyward. On-chain data timestamps it at 17:04:49 UTC on 1 November 2022.

About 1.1 million wrapped NEAR left the treasury. The dollar figure depends on the conversion used: The Block reported roughly $3 million, BlockAudit roughly $3.2 million. BlockAudit also reports the SKYWARD token falling from about $14 to about $0.30 in the days that followed; The Block does not discuss the token price.

The published dates are unreliable and the chain settles the question. BlockAudit dates the exploit to 2 November 2022 while elsewhere in the same post referring to the attack as occurring on 3 November; The Block's report says 3 November. The transaction itself executed on 1 November, so the reported dates reflect a reporting lag of one to two days rather than a timezone boundary.

No recovery, reimbursement or identification of the attacker has been reported.