Slow Fog: The UvToken mining pool contract was hacked due to the failure to check the validity of user parameters, resulting in the attacker profiting over 5000 BNB

ChainCatcher message, according to Slow Mist intelligence, the UvTokenWallet Eco Staking pool contract has been hacked. The key reason for the vulnerability is that the withdrawal function of the pool contract does not strictly validate user input, allowing attackers to directly input malicious contract addresses and exploit the malicious contract to drain the related funds.

Slow Mist's MistTrack has conducted tracking and source analysis of the funds: as of now, the hacker has transferred a total of 5,011 BNB in profit to Tornado Cash. In addition, the transaction fees for the attack also originated from Tornado Cash.