🚨 DoinGud (@DoinGudHQ) has just been hacked for ~$35K USDC 🚨 I had discovered the vulnerable contract around a week before the hack. 🧵Here's what happened: (1/15)

~1 week ago, I discovered the DoinGud Diamond contract on Polygon had a bug, allowing anyone to drain the ERC20 balance, which was $35,487 USDC before the hack. 🧵(2/15)

The bug caused bids to be reusable - in acceptBid(bidder, id, price, qty), there are no SSTOREs other than for the reentrancy guard - the bid payout runs, but the bid record is never cleared. 🧵(3/15)

This meant anyone could flash loan USDC equal to the contract's balance, place a bid on themselves, and accept it twice - draining the contract. DoinGud Diamond Contract: polygonscan.com/address/0xe3… DoinGud Vulnerable Facet: polygonscan.com/address/0x12… 🧵(4/15)

I started searching for DoinGud and found that it was a dead project (last tweet in 2023). The contract itself was inactive, with activity stopping ~1000 days ago. 🧵(5/15)

As such, it was very unclear who to contact for disclosure, and my initial outreach didn’t turn up any leads. Given how long it had sat untouched, I unfortunately didn't treat it with enough urgency. 🧵(6/15)

I considered whitehat hacking it - with the project being dead it was unlikely we would get a response from their team, and given how trivial the bug was to exploit, I wouldn’t be surprised if it gets hacked at some point. 🧵(7/15)

However, being familiar with the Dark Forest (see paradigm.xyz/writing/ethereu… ), I knew it wasn't as simple as straight up sending the exploit transaction on mainnet. 🧵(8/15)

Although Polygon has a faster block time of ~2 seconds, thus any generalized MEV bot would have a much shorter time to reverse and send their own transaction, I didn't want to take the risk of being frontrun, or having a failed tx or chain reorg exposing the bug. 🧵(9/15)

I found that Polygon offers a private mempool to prevent MEV. However, access had to be requested through their forms. I submitted the form around 4-5 days ago, but as of now, I haven't yet received a response. Polygon Private mempool post: polygon.technology/blog/poly… 🧵(10/15)

Fast forward to today, I wake up and check the contract on polygonscan, and watch as the page loads and reveals Token Holdings of $0. Sure enough, checking the token transfers, I see a single transaction transferring $35,486 USDC out. 🧵(11/15)

Exploit transaction: polygonscan.com/tx/0x56818a6… Attacker EOA: polygonscan.com/address/0xb8… Attacker contract: polygonscan.com/address/0xe5… 🧵(12/15)

In hindsight, I definitely should've contacted @SEAL_911 / @_SEAL_Org , who specialize in handling cases like these. While $35K is not massive compared to other hacks, it's still upsetting that I took so long and could've prevented this or hacked it myself. 🧵(13/15)

After days and eventually weeks after discovering the contract and having it remain unexploited, I just kind of hoped that since it hadn't been exploited today, it wouldn't be exploited tomorrow. 🧵(14/15)