Beosin: Dexible project hacked, stolen funds about $1.54 million

According to the Beosin EagleEye security risk monitoring, early warning and blocking platform monitoring of the blockchain security audit company Beosin, the Dexible project contract has been hacked. The Beosin security team analyzed and found that there is a logic loophole in the selfSwap function of the Dexible contract, which will call the fill function. This function has a call to the attacker's custom data, and the attacker constructs a transferfrom function in this data, and transfers other users ( 0x58f5f0684c381fcfc203d77b2bba468ebb29b098) and its own attack address (0x684083f312ac50f538cc4b634d85a2feafaab77a), causing the tokens authorized by the user to the contract to be transferred by the attacker. The stolen funds amounted to approximately 1.54 million, and Beosin Trace traced that the attackers had transferred the stolen funds to Tornado Cash. Beosin reminds users: Cancel the token authorization for the 0xde62e1b0edaa55aac5ffbe21984d321706418024 address to prevent theft!