Security Incident · Fantom Ecosystem
SpookySwap Malicious Code Injection Attack: $5.00K Reported Loss
DEX SpookySwap on Fantom tweeted that the team is investigating a frontend vulnerability on their domain.
- Reported loss
- $ 5,000
- Attack category
- Malicious Code Injection Attack
Incident Overview
Please do not execute any transactions on the DEX. On November 19, Spooky updated that a 3rd party JavaScript plugin enabled code injection from npm packages. This enabled replacing the spooky router contract on the Spooky Fi frontend with a malicious contract which sent funds that users attempted to swap to the exploiter.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.