four.meme was attacked by hackers, the loss was about 15,000 USD

Four.meme, a memecoin launchpad incubated by Binance Academy, is attacked by hackers

We noticed that memecoin snowboard ( https://four.meme/token/0x4abfd9a204344bd81a276c075ef89412c9fd2f64 ) on the platform was attacked by hackers. The loss was about 15,000 USD. The attack transaction was: https://bscscan.com/tx/0x2902f93a0e0e32893b6d5c907ee7bb5dabc459093efa6dbc6e6ba49f85c27f61

Attack and incident analysis

Principle of Four.meme

four.meme is a memecoin launchpad on bnb smartchain, similar to pump.fun. Three main stages of similar launchpad platforms:

• Phase 1: Users create memecoins on the platform by customizing their names, logos, descriptions, social accounts (optional), etc.

• Phase 2: Other users can buy and sell the memecoin on the platform

• Phase 3: When the market value of the memecoin reaches a certain threshold (24 BNB), it will be migrated to DEX (PancakeSwap)

Below, we take a closer look at the specific technical details of each stage.

Phase 1

On the launchpad platform, users fill in the specific information of the memecoin they want to create through the interface.

After filling in the form, pay the handling fee to complete the creation of the memecoin on-chain contract. Of course, this contract is created by the official contract of launchpad, so the owner of the created ERC-20 Token is also the official contract of launchpad. Let's take a look at an example of memecoin creation by four.meme:

First, the user pays the handling fee, the launchpad official contract completes the deployment of the memecoin ERC-20 Token contract, and mints 1,000,000,000 initial funds (the total virtual pool of the memecoin is expected to be 30 BNB).

Then, we see that the owner of the created Token is also the smart contract of the launchpad official website.

This means that although memecoin is created by the user on launchpad, the owner of the ERC-20 contract on the chain is not the user. This can prevent malicious behaviors such as users minting on their own. Once the memecoin smart contract is deployed on the chain, it enters the second stage, and all users on the platform can buy and sell.

Phase 2

Other users on the platform can buy and sell through the platform, but the tokens after buying and selling cannot be transferred to other users through transfer. We can take a look at the source code of the ERC-20 Token on the chain.

In _beforeTokenTransfer, the transfer is restricted by the parameter _mode

At this point, we can see that the _mode corresponding to the Token in phase 2 is 1, which is MODE_TRANSFER_RESTRICTED, restricting third-party transfers.

This is to prevent the influence of OTC on the price. When buying and selling, the four.meme contract sets _mode to 2 first and then uses transfer to transfer to the user. After the transfer is completed, _mode is set to 1 to restrict other users from transferring. To complete the transfer of memecoin after purchase.

Phase 3

When the market value of the memecoin reaches 24 BNB, the Bonding Curve Process reaches 100%. Launchpad will migrate the remaining 20% of memecoin and 24 BNB to DEX PancakeSwap. At this point, Phase 3 is officially completed. The following transaction is the transaction in which Launchpad migrated the memecoin to PancakeSwap.

We can see that first, launchpad officials set the _mode of memecoin to 0, that is, MODE_NORMAL, allowing users to conduct over-the-counter transactions. Then, launchpad officials created a trading pair of memecoin and WBNB, and finally added 23.5BNB (0.5 BNB is the fee) and 200 million memecoin liquidity to the trading pair. The price of adding liquidity is sqrtPriceX96 = 27169599998237907265358521. Because the calculation formula of sqrtPriceX96 is as follows:

Therefore, the price of this memecoin when adding liquidity is 0.0000001175 WBNB, which can also be obtained by dividing 2