Slow Mist: GenomesDAO was hacked, resulting in unexpected withdrawal of funds in its LPSTAKING contract

According to the hacktivist in Slow Mist, the @GenomesDAO project on Polygon was hacked, resulting in unexpected withdrawal of funds in its LPSTAKING contract. The reason for this incident is that the LPSTAKING contract of GenomesDAO can be initialized arbitrarily and repeatedly to set key parameters, causing the collateral in the contract to be maliciously exhausted. The SlowMist security team analyzed as follows: 1. Since the initialized function of GenomesDAO’s LPSTAKING contract is publicly callable and has no permission and cannot be re-initialized, the attacker uses the initialized function to set the contract’s stakingToken to a fake LP token created by the attacker. 2. Then the attacker uses the stake function to mortgage fake LP tokens to obtain a large number of LPSTAKING mortgage certificates. 3. After obtaining the certificate, set the stakingToken of the contract to the original real LP token through the initialized function again, and then destroy the LPSTAKING certificate through the withdraw function to obtain the real LP collateral in the contract. 4. Finally, send LP to DEX to remove liquidity for profit.