GANA Theft Review: Private Key Leakage + Parameter Tampering, the Full Process of Attacking from Hundreds of U to Tens of Thousands of U

[Bit推] The GANA project recently experienced a major security incident — the attacker only staked a few hundred USDT, but ended up withdrawing hundreds of thousands of USDT when unstaking.

A certain security expert discovered after a deep dive that the root cause lies in the leak of the Owner private key of the GANA Payment Stake contract. However, the attackers did not simply and rudely transfer the funds; instead, they used some technical maneuvers: first, they bypassed the onlyEOA check in the unstake function with the 7702 deleGate operation (this check was originally to prevent bots), and then quietly changed the Rate and Fee parameters in the contract.

With this set of combo punches, the exchange rate for staking and unstaking has been completely distorted. Essentially, it is through tampering with the core parameters of the smart contract that the withdrawal rules have been changed to a version favorable to the attacker.

This matter proves once again: there can be no negligence in private key management, and contract permission design also requires multiple layers of protection.