Digital asset exchange OKEX announced today that it suspended deposits of all ERC-20 tokens “due to the discovery of a new smart contract bug – BatchOverFlow.” The bug allows hackers to exploit certain ERC20 smart contracts by spinning up vast amounts of tokens out of thin air.
Multiple exchanges, including HitBTC, Poloniex, Changelly and QUOINE, also temporarily suspended trading.
Poloniex
Poloniex re-enabled deposits and withdrawals for all ERC20 tokens.
HitBTC
HitBTC is tracking every coin’s status on their System Health page.
OKEX
OKEX reports, “To protect public interest, we have decided to suspend the deposits of all ERC-20 tokens until the bug is fixed. Also, we have contacted the affected token teams to conduct investigation and take necessary measures to prevent the attack.” The exchange notes that abnormal trading activity first began with BeautyChain (BEC) at around 13:00 on April 22 (Hong Kong Time).
SmartMesh
SmartMesh (SMT), an ERC20 token, has responded with an update:
A whopping 65,133,050,195,990,400,000,000,000,000,000,000,000,000,000,000.891004451135422463 counterfeit tokens were created due to the smart contract hack.
The major exchanges where SMT is listed, such as Huobi, Gate, OKEX, CEX, suspended SMT trades and transfers, “and the loopholes have been repaired.” The SmartMesh Foundation will destroy tokens to stop price manipulation and keep the total supply of SMT at the value of 3,141,592,653.
The Details
The BatchOverFlow bug was detailed on April 23rd by user ranimes in a Medium blog, “New batchOverflow Bug in Multiple ERC20 Smart Contracts (CVE-2018–10299).”
Addressing the ERC20 fear, uncertainty and doubt (FUD), Dan Emmons, a certified Ethereum and full stack developer who posted on Medium, claims the problem can be solved. “It’s essentially the same type of overflow that can occur in any type of arithmetic, since multiplication is just repetitive addition. The problem can be avoided: using SafeMath for uint256.”
Enigma
Enigma, an ERC20 project incubated at MIT Media Lab, updated their community with a tweet that they were not affected by the smart contract bug.
Below is a partial list of coins that were affected by the BatchOverFlow bug.
| 1 | MESH | 0x3ac6cb00f5a44712022a51fbace4c7497f56ee31 |
| 0x01f2acf2914860331c1cb1a9acecda7475e06af8 | ||
| 2 | UGToken | 0x43ee79e379e7b78d871100ed696e803e7893b644 |
| 3 | SMT | 0x55F93985431Fc9304077687a35A1BA103dC1e081 |
| 4 | SMART | 0x60be37dacb94748a12208a7ff298f6112365e31f |
| 5 | MTC | 0x8febf7551eea6ce499f96537ae0e2075c5a7301a |
| 6 | FirstCoin | 0x9e88770da20ebea0df87ad874c2f5cf8ab92f605 |
| 7 | GG Token | 0xf20b76ed9d5467fdcdc1444455e303257d2827c7 |
| 8 | CNY Token | 0x041b3eb05560ba2670def3cc5eec2aeef8e5d14b |
| 9 | CNYTokenPlus | 0xfbb7b2295ab9f987a9f7bd5ba6c9de8ee762deb8 |