Simulation Exploits Drain $3.48M From 5,700 Victims

Woofun AI reports that a July 30 arXiv preprint exposes how transaction simulation flaws in smart contracts enabled the theft of approximately $3.48 million from 5,742 victim addresses.

The scope of this attack involved 6,223 victim transactions. While the study cites $3.48 million in historical losses, it defines this figure as an upper bound, acknowledging that some attacker test activity may have been misclassified.

Structurally, 91.5% of the losses occurred on Ethereum, with 83% of the cross-chain total attributed to its largest inferred cluster. The paper, which has not been peer reviewed, presents inconsistent figures for its Avalanche contract count and conflicting endpoints for the observation period, leaving its per-chain breakdown and exact time window unresolved.

Woofun AI data shows that these contracts exploit pre-signing snapshot branches to mask theft; for instance, a storage-control example returns a deposit plus a tiny reward during simulation, but an attacker-controlled address receives the funds after blacklisting the user. Timestamp-based contracts leverage later block time, while gas-control contracts manipulate gas limits to hide losses, with tests showing previews displaying a positive estimate even when only 1 wei, the smallest unit of ETH, was returned.

To mitigate these risks, the authors recommend re-running simulations when relevant contract state or gas fields change, specifically using the gas limit and gas price in the actual request and testing current and future block-number and timestamp inputs. Their UI findings also support showing the gross amount leaving a wallet alongside an accurate net balance change, ensuring a negligible refund cannot be mistaken for a profit, though the aggregate results remain the authors' findings rather than an independently reproduced measurement.