Ridiculous: Only $500 offered to solve a $5 million hack

A security organization led by Ethical Hackers, who specialize in security audits, has claimed that the platform will be offered a $500 reward by DxSale Network, a decentralized token launchpad, after reporting a breach that could be worth more than $5 million.

This reward is one of the lowest ever awarded to a white hat hacker.

$500 reward for saving $5 million

Decurity, recently blog postrevealed that one of its researchers discovered a bug in an unverified smart contract on the Binance Smart Chain (BSC) belonging to DxSale on June 28, 2023, and was rewarded $500 for his efforts.

According to the firm, the investigation revealed a contract logic that was not secure enough to prevent hackers from withdrawing funds locked in the contract during an initial decentralized offering (IDO).

Based on calculations, a total of 21,600 WBNB (wrapped BNB) tokens worth approximately $5.2 million could have been stolen from the pool at the time of report if hackers had noticed the vulnerability. Meanwhile, the security firm said:

“Note that this figure shows the damage that could be done by an exploit targeting a single instance of the locking contract. However, Dx has more locking contracts on BSC and other chains.”

Alleged bad response from DxSale

Decurity claimed to have contacted DxSale after confirming the bug, but said they first encountered friction from the project’s team, which was initially unresponsive, and later claimed to be aware of the problem. According to the blog post, the team said that the contract in question was inactive, meaning it was not at risk.

Despite DxSale’s initial response, Decurity said it was able to contact DxSale’s founders and developers to discuss the situation.

As a way to fix the bug, the project’s developers decided on June 29 to set higher locking fees as a solution to the problem to discourage attackers from taking action. According to Desecurity, the solution could deter hackers, but DxSale owners could lose funds in the event of a potential breach.

Although the Dx team tried to debunk claims of hackers being able to siphon off funds, citing security from multiple auditing partners, including CertiK Skynet, the project reportedly went on to set higher fees on other chains.

Meanwhile, Decurity expressed some concerns about DxSale’s response to potential security threats, and advised users to be careful when interacting with projects on the protocol.

While DxSale has not responded to Desecurity’s claims, Decentralized Launchpad has announced Partnerships With security organization Vital Block Security on July 18.