xToken (xSNX) hack — August 2021

xToken, an Ethereum protocol that issued tokenised versions of yield strategies, lost about $4.5 million from its xSNX product on 29 August 2021 at 04:43 UTC. It was the protocol's second major exploit that year, following a roughly $24.5 million loss in May.

The root cause, set out in xToken's own post-mortem, was an access control bug in the xSNXAdmin contract. A callback function intended to be reachable only by dYdX's SoloMargin flash loan contract checked the wrong condition, comparing against the contract's own address instead of SoloMargin's, which left the function callable by anyone.

The attacker combined that flaw with price manipulation. They took a 25,000 ETH flash loan from dYdX and borrowed around one million SNX from Aave, then traded across Bancor, Kyber and Curve to push the price of SNX down. With SNX artificially cheap, they invoked the exposed callback to make the xSNX contract buy SNX at the depressed price, then unwound the trades and repaid the loans, keeping the difference. Halborn's later analysis reached the same conclusion and noted that the vulnerable code had been added within the three months before the attack, after the contract had been audited.

xToken said it would sunset xSNX, which it described as by far its most complicated product, and announced a compensation programme denominated in its XTK token, with snapshot scripts written to calculate individual losses including for holders who redeemed after the exploit. The stolen funds were not recovered and no attacker has been publicly identified or charged.