Security Breach Hits BonfireSwap DeFi Project on BSC, User Funds Drained

Blockchain security firm SlowMist has reported a security incident involving the BonfireSwap decentralized finance (DeFi) project on the Binance Smart Chain (BSC). The attack, which occurred on September 16, resulted in the loss of user assets. Preliminary assessments indicate approximately 41 token holders were affected, with total losses estimated around $50,000.

Root Cause: Missing Access Control in Router Contract

Technical analysis reveals the exploit stemmed from a critical design flaw in the project's router contract. Specifically, the contract's transfer function lacked proper access control mechanisms.

  • Core Vulnerability: The function failed to verify whether the caller (msg.sender) was the same as the transfer initiator (from). It also did not check the caller's approved spending allowance for the from address.
  • Exploitation Path: This allowed an attacker to arbitrarily designate any victim's address as the from parameter while setting their own controlled address as the recipient (to).

Attack Method: Leveraging Pre-Approvals and Token Pool Swaps

The attacker executed a multi-stage process leveraging this vulnerability:

First, the attacker targeted regular users who had previously granted token approvals to the BonfireSwap router contract. Due to the contract flaw, the attacker could bypass permission checks, directly call the transfer function, set the victims' addresses as the sender, and effectively "initiate" transfers on their behalf.

Subsequently, the stolen tokens were funneled into the project's same-token liquidity pools for swap operations, ultimately enabling the attacker to move the funds out and realize gains. The entire exploit capitalized on a logic flaw within the contract rather than breaking cryptographic schemes.

Impact and Takeaways

This incident, impacting 41 users, serves as another stark reminder of security risks within the DeFi space. It underscores the critical importance of implementing rigorous access control and input validation in smart contracts, especially for core functions handling asset transfers. For users, it highlights the need for caution when granting contract approvals, limiting permissions to only necessary and trusted contracts.

Project developers must conduct thorough security audits and testing prior to contract deployment, with particular focus on permission management and state-changing operations, to prevent the exploitation of similar vulnerabilities.