SubQuery Network exploited for $130K via missing access control on Settings contract, allowing attacker to replace critical protocol addresses and drain staking rewards.
Security & Exploits ·
SubQuery Network lost approximately $130,000 on April 12 when an attacker exploited missing access controls on the protocol's Settings contract. The vulnerability allowed anyone to call setContractAddress() and setBatchAddress() functions without authorization, enabling the attacker to replace critical protocol addresses including StakingManager and RewardsDistributor with a malicious contract. By redirecting the staking logic through their exploit contract, the attacker was able to unbond and withdraw 218 million SQT tokens from the staking contract before restoring the original addresses to obscure the attack.
The exploit succeeded because the Staking proxy relies on the Settings contract to resolve dependent contract addresses at runtime. When the attacker substituted their own contract as the legitimate staking manager, the system treated it as such and processed the unauthorized withdrawal. The Settings contract lacked onlyOwner modifiers or equivalent access control mechanisms on its critical setter functions, leaving the protocol exposed.
At the time of the incident, SQT was trading at $0.000601 with a market capitalization of $2.27 million and 24-hour volume of $101,800. The attack highlights a fundamental failure in contract design: functions that modify core system parameters require strict permission checks. No details have been disclosed regarding whether affected users will be compensated or what remediation steps the protocol intends to implement.