Pirate Chain Suffers $10.7 Million Loss from Transaction Validation Vulnerability
A vulnerability in Pirate Chain's source code led to the unauthorized creation of ARRR tokens, resulting in a significant financial loss. The exploit involved two validation failures that allowed the increase of the total supply by approximately 20%.
A transaction validation vulnerability in Pirate Chain's source code resulted in the unauthorized creation of approximately 39.8 million ARRR tokens, leading to a loss of about $10,746,000. This incident increased the total supply of ARRR by roughly 20%. The newly minted funds were subsequently transferred into the Sapling shielded pool, raising concerns about the integrity of the token's supply and distribution.
The exploit was attributed to two specific validation failures: the bypassing of the issuance check and an incorrect interpretation of the output scripts. These failures allowed the unauthorized tokens to be generated without proper validation, which is critical for maintaining the security of the blockchain. In response to the incident, NonKYC identified suspicious deposits, restricted the associated accounts, and blocked withdrawals to mitigate further risks.
As a precautionary measure, dPoW operators suspended notarizations, and exchanges and pools were advised to pause their operations while a recovery plan was developed. The incident highlights the importance of robust validation mechanisms in blockchain protocols to prevent unauthorized actions that can lead to significant financial losses.