How hackers can penetrate our smart contract function calls?

Question

I used this code in a smart contract method on Polygon blockchain:

function withdraw() public {
    iERC20 tether = iERC20(0xc2132D05D31c914a87C6611C10748AEb04B58e8F);
    tether.transfer(msg.sender, tether.balanceOf(address(this)));
}

Note: I forgot to make this function onlyOwner.

At the beginning there was 50 Tethers in the smart contract. When I called this method, 0 tether transferred to my wallet and the smart contract became empty!

I traced the transaction and wondered to see this consecutive transactions in the smart contract at one block:

The last destination at the top is my wallet and both of the other destinations accounts are contracts:

0xa8f4098f0c9b5b3ab59844d0d5e070f8f7524ec9

0x4bfd2181be8fa2f6702dee41a46baabeb5d3dd3d

Note that the destination 0xa8f4... is marked as instant withdrawals and was instantly discharged.

How hackers can aware this vulnerability of a method and send their transactions instantly before my transaction? Are they in the Polygonscan organization that receive our sent transactions?

Note: I sent my transaction via Metamask wallet.

Answer 1

It seems like what you experienced is a frontrunning attack.

Frontrunning is a type of transaction manipulation where an attacker exploits the predictability of a transaction's execution to their advantage. In your case, the attacker likely monitored the blockchain for pending transactions and quickly submitted their own transaction to execute before yours.

Here's how the attack likely unfolded:

1. Your transaction to withdraw Tether from the smart contract was broadcasted to the network.

2. An attacker monitoring pending transactions saw your transaction and quickly submitted their own transaction to withdraw Tether from the same smart contract but with a higher gas price.

3. Miners prioritize transactions with higher gas prices, so the attacker's transaction got included in the block before yours.

4. The attacker's transaction emptied the smart contract, leaving no Tether for your transaction to withdraw.

Regarding your question about whether hackers are affiliated with Polygonscan or similar blockchain explorers:

It's highly unlikely that hackers are affiliated with blockchain explorers like Polygonscan. These platforms merely provide a user interface to interact with the blockchain and explore transactions. They don't have the ability to manipulate transactions or influence their execution. Instead, attackers use various tools and monitoring techniques to identify and exploit vulnerabilities like frontrunning.

Answer 2

Such critical function should have a condition to make sure that you wont lose your funds. That could be easily avoided with hard coding

Ex1:

address withdr1 = "addrsx0000" - declared into the contract variables

address withdr2 = "addrsx0000" - declared into the contract variables

require(msg.sender == withdr1 || msg.sender == withdr2 , "You are not allowed to perform this action); - declared before executing the transfer

Ex2:

address contractorAddress=msg.sender; - declared into the contract variables

require(msg.sender == contractorAddress, "You are not allowed to perform this action); - declared before executing the transfer