Poolz suffered an arithmetic overflow attack, resulting in a loss of approximately $665,000.

Recently, the Poolz project on the Ethereum, Binance, and Polygon networks was attacked by hackers, resulting in significant losses. According to on-chain data, the attack occurred on March 15, 2023, involving multiple tokens with a total value of approximately $665,000.

The attacker exploited an arithmetic overflow vulnerability in the Poolz contract to carry out this attack. The main issue occurred in the CreateMassPools function, which allows users to create liquidity pools in bulk and provide initial liquidity. By carefully crafting the input parameters, the attacker caused the getArraySum function to overflow, resulting in a massive value being recorded in the system with only 1 token being transferred in.

The attack process is as follows:

1. The attacker first exchanged some MNZ tokens through a decentralized exchange.

2. Then call the CreateMassPools function, utilizing the vulnerability in the getArraySum function within it. This function returns 1 due to overflow when summing the user input _StartAmount array, while the actual recorded value is a number far greater than this.

3. Finally, the attacker completed the entire attack process by calling the withdraw function to extract funds.

This incident once again highlights the seriousness of arithmetic overflow issues in smart contracts. To prevent similar problems, developers should consider using newer versions of the Solidity compiler, which automatically perform overflow checks during the compilation process. For projects using earlier versions of Solidity, third-party security libraries can be utilized to address integer overflow issues.

This attack also reminds us that when dealing with smart contracts that involve a large amount of computation, we must be especially cautious and ensure that all possible edge cases are properly handled. At the same time, conducting regular security audits and implementing bug bounty programs are also effective measures to ensure project safety.