PlayDapp
From Invertopedia, the encyclopedia of how things fail
PlayDapp is a blockchain gaming platform with a token called PLA. On February 9, 2024, an unauthorized wallet minted 200 million PLA, and on February 12 it minted 1.59 billion more, for 1.79 billion tokens valued at about $290 million at market price[1][2]. Only 577 million PLA had been in circulation, so the minted tokens would have been hard to sell near that value[2].
What happened
| Feb 9, 2024 | An unauthorized wallet mints 200 million PLA.[1] |
|---|---|
| Feb 10, 2024 | PlayDapp offers a $1 million white-hat reward by Feb 13 for returning the assets.[1] |
| Feb 12, 2024 | The attacker mints 1.59 billion more PLA.[1][2] |
| Feb 13, 2024 | PlayDapp suspends deposits and withdrawals and freezes the attacker's wallets on major exchanges.[1] |
The kill shot
Someone other than PlayDapp could mint PLA, either through a leaked private key or an access control flaw that let the attacker add itself as a minter.
BleepingComputer cited PeckShield on a possible leaked key[1]; Halborn described an access control flaw that let the attacker become an official minter[3]. The sources differ and the cause was not settled in what we read.
The inversion
A token whose supply one key can change is only as safe as that key. Cap minting and require more than one signer.
References
- ^ “Hackers mint 1.79 billion crypto tokens from PlayDapp gaming platform”. BleepingComputer, February 13, 2024. Both mints, the bounty, the suspension and the leaked-key possibility.
- ^ “PlayDapp Gaming Platform Suffers $290 Million Loss in Dual Exploits”. ForkLog, February 14, 2024. The 577 million supply before the breaches and Elliptic's point about selling.
- ^ “Explained: The PlayDapp Hack (February 2024)”. Halborn, February 14, 2024. Access control flaw that let the attacker become a minter.