ATM Token BlindBox gambling contract exploited via predictable blockhash RNG, draining ~13M ATM tokens through selective bet settlement.
Security & Exploits ·
A vulnerability in the ATM Token BlindBox gambling contract allowed an attacker to drain approximately 13 million ATM tokens by exploiting a predictable random number generator. The contract determined bet outcomes using blockhash(N+2), which is publicly readable on-chain before settlement occurs. This design flaw enabled the attacker to selectively settle only winning bets while avoiding losing ones, effectively achieving near-perfect win rates across roughly 150 rounds spanning blocks 87515680–87524257.
The attacker executed approximately 105,000 bets per round in single transactions, leveraging the fact that all bets placed in the same block share an identical blockhash result. By checking the blockhash off-chain before calling the settlement function, the attacker could choose to settle only rounds that would yield a 1.95x payout on winning positions. The tokens were subsequently extracted from the victim contract's DEAD address and dumped on PancakeSwap.
The incident highlights a fundamental design failure: using blockhash as a source of randomness in a smart contract where settlement logic can be called selectively by participants. The loss totaled approximately $99,000 in drained value. No patch status or recovery mechanism has been disclosed at this time.