
Malba0x
297 posts

Malba0x
@malba0x
AppSec & Web3 Security Engineer | Full-Stack background | Breaking smart contracts & web apps legally | Open Source Builder



What controversial opinion will have you in this position?


Someone borrowed $1 billion, used it to vote themselves the right to rob a protocol, took $182 million and then even returned the billion In April 2022 an attacker took a $1 billion flash loan from Aave and used the borrowed money to buy enough governance tokens to control Beanstalk's voting system With 70% of the votes in hand they passed an emergency proposal that contained hidden code to drain every dollar from the protocol into their own wallet $182 million transferred in a single transaction Then he repaid the $1 billion loan in the same block because flash loans have to be returned instantly Profit: $76 million The protocol's lead dev went on Discord and wrote "We are fucked" The attacker also sent $250K to a Ukraine donation wallet during the robbery and then laundered everything else through Tornado Cash in 270 transactions The governance function that made this possible was never audited before it went live







@Timon_adebiyi No charger, no problem 👌




















