[IMPORTANT] 16 Apr Community Update: WonderHero BNB Chain Bridging Withdrawal Compromised

// DETAILS OF THE ATTACK

On 7 Apr 2022, a hacker invaded WonderHub, bypassing the risk control module to gain access to the cross chain withdrawal interface on the BNB chain.

// ACTIONS TO ENHANCE SECURITY AND INCREASING RISK CONTROL

After an exhaustive security review, our team has formulated a comprehensive enhancement plan and we target to complete all the upgrades before we release the new WND tokens.

  1. Mitigate the current risks of WND minting that exist during cross chain token withdrawal, we will adopt a transfer method using a Token withdrawal pool. This will enable us to control the amount of WND token in the pool at any point of time.
  2. Deploy real time monitoring of the WND minting on the BNB chain, and reinforcing it with a time lock and secondary audit mechanism. The time lock mechanism will prevent hackers withdrawing from the token pool immediately, giving our team time to prevent damage from taking place.
  3. Improve the development team system and processes, as well as giving the risk control team more power to decide against major technical risks by implementing a veto system.

// TOKEN HOLDERS SNAPSHOT EVALUATION

For WND token holders and WND liquidity providers, please take note of this section. Our team has also taken the snapshot prior to the attack on 7 April 2022, 14:53pm (GMT+8) before block 16731166, and here is the breakdown after the evaluation of the token holders situation:

  1. [WND tokens unaffected by the attack]
  • WND deposited into the game account
  • WND earned from WonderHero in-game
  • WND earned from PVP rank and lottery rewards
  • WND earned from NFT staking.
  • WND on the HECO chain.
  • WND on Huobi Exchange
  • WND on BNB Chain address. (eg. WND on Metamask wallet)
  • WND in Stake WND earn HON pool
  • WND in Lock WND
  • WND earned from WND-BNB LP and is yet claimed.
  • WND on Gate Exchange (we are currently in talks with Gate and will strike a recovery solution.)
  • Hold WND-BNB LP on BNB Chain address
    We’ll airdrop new LP tokens to the wallet address.
  • Stake WND-BNB LP on WonderHero staking platform.
    We’ll release a new LP staking pool and airdrop the same amount of new LP tokens in.
  1. [WND tokens that are affected, actions required by token holders]
  • If you have $WND in non-official smart contract addresses (eg. unredeemed $WND tokens from IDO), you will not receive the airdrop directly, please contact us via our support system on app.wonderhero.io.
  • If you have WND on other exchanges besides Gate.io and Huobi, please contact the respective exchange directly for replacement of the tokens. As we will need to work with each exchange individually to resolve the issues, a longer duration may be expected.

// NEXT STEPS

Our team is targeting the release of the new $WND token by 28 April 2022. The following steps will be completed prior to the release of new $WND tokens:

  • Snapshot details will be published on our website for $WND token holders.
  • Backend security checks and smart contract upgrades to be completed.
  • Improvised and verified bridge.
  • Full audit on smart contracts and bridge.
  • Release of new $WND Contract Address. (Once the new contract is released, the old $WND contract will be severed from WonderHero.)
  • Bridging reopens with new liquidity pool. (we will put the same liquidity amount prior to the attack)
  • Resume deposit and withdrawal of $WND/$HON from account to wallet.
  • Airdrop new $WND token to token holders.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
WonderHero

WonderHero

3.1K Followers

WonderHero is NFT play-to-earn mobile game. The game is a turn-based MMORPG for iOS/Android where players collect Heroes, enter RPG combat and earn tokens.