SlowMist: The root cause of the pGALA incident is that the plaintext of the private key was leaked on GitHub

According to Slow Mist, on November 4, an address on the BNB Chain minted more than US$1 billion of pGALA tokens out of thin air, and sold them through PancakeSwap for a profit, causing GALA to drop by more than 20% in a short period of time. SlowMist analysis results are as follows: 1. The pGALA contract uses a transparent proxy (Transparent Proxy) model, which has three privileged roles, namely Admin, DEFAULT_ADMIN_ROLE and MINTER_ROLE. 2. The Admin role is used to manage the upgrade of the proxy contract and change the Admin address of the proxy contract. The DEFAULT_ADMIN_ROLE role is used to manage the privileged roles in the logic (such as: MINTER_ROLE), and the MINTER_ROLE role manages the pGALA token minting authority. 3. In this event, the Admin role of the pGALA proxy contract is specified as the proxyAdmin contract address of the transparent proxy when the contract is deployed, and the DEFAULT_ADMIN_ROLE and MINTER_ROLE roles are specified to be controlled by pNetwork during initialization. The proxyAdmin contract also has an owner role, which is the EOA address, and the owner can upgrade the pGALA contract through proxyAdmin. 4. However, the SlowMist security team found that the plaintext of the private key of the owner address of the proxyAdmin contract was leaked on Github, so any user who obtains this private key can control the proxyAdmin contract to upgrade the pGALA contract at any time. 5. The owner address of the proxyAdmin contract has been replaced 70 days ago (August 28, 2022), and another project pLOTTO managed by it is suspected to have been attacked. 6. Due to the architecture design of the transparent proxy, the Admin role change of the pGALA proxy contract can only be initiated by the proxyAdmin contract. Therefore, after the owner permission of the proxyAdmin contract is lost, the pGALA contract is already at risk of being attacked at any time. To sum up, the root cause of the pGALA incident is that the owner private key of the Admin role of the pGALA proxy contract was leaked on Github, and its owner address was maliciously replaced 70 days ago, resulting in the pGALA contract being at risk of being attacked at any time.