Swan Treasury exploited for $625K via leaked off-chain signer private key, allowing attacker to forge signatures for discounted token purchases and flash-loan-assisted dumps.
Security & Exploits ·
Swan Treasury's STY token suffered a $625K loss on BNB Chain after an attacker gained access to the protocol's off-chain signer private key. The compromised key, hardcoded within the ZhaiquanBuy contract, enabled the attacker to forge valid signatures for discounted token purchases. By crafting signatures with a 1x discount multiplier on a function that normally applies a discount divisor, the attacker acquired approximately 687K STY for roughly 19.7K USDT using a PancakeSwap flash loan, then dumped the tokens into the STY/USDT pool for approximately $625K in proceeds.
The exploit demonstrates how hardcoded signer keys create a single point of failure in signature-based access controls. Every ecrecover operation in the attacker's transaction resolved to the exact hardcoded signer address, confirming the private key itself was compromised rather than a flaw in signature validation logic. The attacker also forged signatures on sibling contracts to enable transfers and claims, extending the scope of the breach beyond the buy function alone.
The vulnerability now raises questions about how the key was exposed, whether any other on-chain operations by the signer have been compromised, and what recovery or governance steps the victim contract intends to undertake. No information has been provided about whether the leaked signer key remains active or has been revoked.