TL;DR
- An exploit triggered a 94% collapse in the Shido token.
- According to PeckShield, the attacker was able to withdraw over 4.3 billion tokens, nearly half of the total circulating token supply.
- The vulnerability of Shido’s Ethereum staking contract raises serious concerns about security.
The recent collapse of the Shido token has shaken the industry, sparking concern and discussions within the community. This event was triggered by an exploit in its Ethereum staking contract, where an attacker managed to transfer billions of tokens to an unknown address. The token’s value plummeted dramatically, reaching up to 94% just 30 minutes after the attack.
The blockchain security firm PeckShield was the first to alert about this incident, highlighting the severity of the exploit and its impact on the Shido ecosystem. According to PeckShield, the attacker managed to withdraw over 4.3 billion tokens, representing nearly half of the total circulating token supply. Before the collapse, the value of these tokens amounted to around $35 million, underscoring the magnitude of the theft.
Hi @ShidoGlobal There is a sudden owner transfer to 0x1982. The new owner immediately upgrades the StakingV4Proxy contract with a hidden withdrawToken() function. This hidden function is then called to withdraw all 4,353,473,223.864904 $SHIDO.
Here are related txs:
– owner… https://t.co/TZ6oMDGwMG pic.twitter.com/VGZtyg9PEf— PeckShield Inc. (@peckshield) February 29, 2024
One of the most concerning aspects of this incident is the vulnerability of Shido’s Ethereum staking contract. The attacker succeeded in transferring the contract to another address and updating it with a hidden function to withdraw staked tokens. This raises serious concerns about the security and robustness of some smart contracts in the crypto space, highlighting the need for increased security attention and rigorous audits in smart contract development.
Shido Seeks to Negotiate with the Attacker and Restore Funds to Affected Users
In response to the attack, the Shido team issued an official statement assuring users that they had taken steps to secure the network against future threats. They also initiated an investigation into the attack and encouraged the attacker to contact them to negotiate a reward. They also promised to return the funds to users who had staked their tokens in the staking contract.
We currently know how the exploit technically happened. We have secured against any further threats against Shido.
A thorough investigation on the hacker is ongoing, we request the exploiter to contact Shido for a bounty.
All users that staked SHIDO, will have their tokens… pic.twitter.com/8YcmDL1Ldc
— Shido (@ShidoGlobal) February 29, 2024
Shido is a layer 1 blockchain that has not yet launched its mainnet. Its token is an Ethereum-based ERC-20 that can be staked on its associated DEX to earn an 8% annual yield. However, this incident raises serious doubts about the viability and security of the project, which could affect its credibility in the market.
At the time of writing this article and according to the latest data provided by CoinMarketCap, SHIDO is trading at $0.002778 after a plunge that is now at 65.3% following a rebound. The transaction volume has grown by 1500%, and the market capitalization has dropped by 65.2%, now standing at just $22,609,110.
