$45M Exploited: UwU Lend, Gala Games, and TCH Breached via Price Oracles, Wallets, and Signature Reuse

UwU Lend bled $23M after a sUSDE price oracle was gamed across Curve pools. Gala Games lost $21.8M to a wallet key compromise and unauthorized GALA minting. TCH token dropped $19K via a signature replay exploit. Same theme, new month: broken assumptions cost millions.

In Brief

• UwU Lend lost $23M due to price manipulation.
• Gala Games was exploited for $21.8M.
• TCH Token was targeted in a $19K attack.

Hacks Analysis

UwU Lend | Amount Lost: $23M

On June 10th, the UwU Lend exploit on the Ethereum Mainnet resulted in a $23M loss. The root cause of the exploit was the use of flash loans to manipulate the sUSDE price. The attacker took a flash loan of around $3.796 billion from various platforms and used the funds to create a leveraged position through recursive borrowing. By manipulating low liquidity pools (USDecrvUSD, FRAXUSDe, USDeUSDC, GHOUSDe, and USDeDAI) on Curve Finance pools, the attacker inflated the sUSDE price and made a profit. The UwU Lend team acknowledged the exploit and paused the protocol.

Exploit Contract: 0xd252953818bdf8507643c237877020398fa4b2e8

Transaction Hash: 0xca1bbf3b320662c89232006f1ec6624b56242850f07e0f1dadbe4f69ba0d6ac3

Gala Games | Amount Lost: $21.8M

On May 21st, the Gala Games exploit on the Ethereum Mainnet resulted in a $21.8M loss. The root cause of the exploit was the compromise of a Gala Games wallet, which allowed the attacker to mint 5B GALA tokens. Before the attacker could swap all the minted tokens, the Gala Games team recovered 4.4B of the stolen assets. The attacker managed to swap 599M GALA tokens for 5,913 ETH.

Exploit Contract: 0xd1d2eb1b1e90b638588728b4130137d262c87cae

Transaction Hash: 0xa6d90abe17d17743a9cecab84bcefb0fd0bbfa0c61bba60fd2f680b0a2f077fe

TCH Token | Amount Lost: $19K

On May 16th, the TCH Token exploit on the BNB Chain resulted in a $19K loss. The root cause of the hack was a vulnerability in the burnToken() function of the TCH contract. This function verifies signatures for authorization but stores used signatures in a mapping to prevent replay attacks. The attacker bypassed the mapping check by modifying the v part of the signature from 0x01 to 0x1c (28). The attacker then burned TCH tokens and manipulated the token price.

Exploit Contract (on BNB Chain): 0x5d78CFc8732fd328015C9B73699dE9556EF06E8E

Transaction Hash: 0xa94338d8aa312ed4b97b2a4dcb27f632b1ade6f3abec667e3bf9f002a75dabe0

‍