An old ICO contract resurfaces after an unusual technical recovery. Security researcher 0xflorent helped unlock nearly $2 million in ether that had been locked up for nine years. Carried out with the HongCoin team, the operation allowed several investors to recover their funds on an old Ethereum contract affected by a bug that was never corrected.
In brief
- 0xflorent helped HongCoin unlock nearly $2 million in ether stuck since 2016.
- The recovery concerns 1,003.62 ETH intended for 48 initial investors.
- The blockage came from an integer overflow flaw in an old Ethereum contract.
- The operation was carried out in coordination with the HongCoin team, via signed transactions.
0xflorent at the heart of ether unblocking
As part of this operation, the security researcher known as 0xflorent worked with the HongCoin team to recover funds that had been blocked since 2016. The relevant ICO contract was to automatically reimburse investors if the fundraising failed. However, a bug prevented the return of ether to some of the participants.
After its analysis, 0xflorent identified an integer overflow flaw in a contract administration function. This weakness made it possible to modify a specific parameter and then authorize the reimbursement. Thanks to this method, 1,003.62 ether was released for the benefit of 48 initial investors.
Two holders have already collected 96.5 ether. Additionally, forty-one separate transactions were signed to release the funds actually blocked.
How a breach tied up funds for nine years
THE HongCoin contract was based on a reimbursement logic that became faulty over time. Indeed, partial redemptions made over the years had reduced the overall counter to 356. This situation prevented new redemptions beyond 3.56 ETH.
Therefore, even though ether was still present in the contract, investors could no longer access it. By examining the code, 0xflorent discovered that a function reserved for administration did not benefit from the protections later integrated into the Solidity language.
Using a specific value in this function reset the holder's balance to one. This modification then made it possible to process the refund and recover the ether blocked for several years.
A coordinated operation on Ethereum
This recovery was not achieved unilaterally. The administration function required authorization of HongCoin's multi-signature wallet. For this reason, 0xflorent contacted the project team before any intervention.
The researcher then validated the procedure on a test version of the Ethereum network. After this verification, the team signed the necessary transactions to unlock the funds. Seven additional cardholders had balances low enough to be paid off directly, without using this method.
This operation constitutes the second recovery made public by 0xflorent in eight days. A few days earlier, he had indicated that he had returned 19,329 ether to their original owners. This new intervention comes as the Ethereum ecosystem is going through a period marked by an increase in attacks targeting decentralized finance protocols.
This spectacular recovery of funds blocked for almost a decade illustrates how errors present in the first smart contracts can continue to produce effects long after their deployment. Thanks to the work of 0xflorent and the collaboration of the HongCoin team, several investors were finally able to recover their assets. This move also serves as a reminder of the importance of security audits and contract maintenance on Ethereum, as the ecosystem continues to deal with the legacy of its early years. In this context, the release of over 1,000 ETH represents a rare example of successful recovery of funds that many considered irrevocably lost.
Maximize your Tremplin.io experience with our 'Read to Earn' program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
