Beosin: The AurumNodePool contract was attacked because the changeRewardPerNode function was not verified

According to the Beosin EagleEye security risk monitoring, early warning and blocking platform monitoring of the blockchain security audit company Beosin, on November 23, 2022, the AurumNodePool contract was attacked by a vulnerability. Beosin analysis found that because the changeRewardPerNode function of the vulnerable contract is not verified, the attacker can call this function to set any value. The attacker first calls the changeRewardPerNode function to set the daily reward value to a very large number, and then calls the claimNodeReward function to extract the node reward, and the calculation of the node reward depends on the rewardPerDay value set by the attacker, resulting in a very high calculated node reward. Before this transaction, the attacker deposited 1000 AUR into the contract through a transaction (0xb3bc6ca257387eae1cea3b997eb489c1a9c208d09ec4d117198029277468e25d), which created the attacker’s node record, allowing the attacker to extract the node reward. In the end, the attacker obtained about 50 BNB (approximately $14,538.04) through this vulnerability.