Four.Meme遭骇13万美元「暂停发射迷因币」攻击是如何发生的？公然打脸CZ
今午有链上玩家披露，BNB Chain 上迷因币发行平台 Four.meme 出现漏洞，攻击者透过 MEV 在 Four.meme 加入 pancake 流动池的时候，提前跑 addLig 操纵价格，导致内盘会瞬间提前加单边池子，来掏空池子。
https://t.co/ghyXiH5BXE
出现大漏洞！！！！！！！！！
通过MEV，再fourmeme加入pancake流动池的时候前跑addLig，操纵价格，内盘会瞬间提前加单边池子掏空池子@four_meme_ pic.twitter.com/T4MDDARUH9
— 币海星辰 (@Zg1000X) March 18, 2025
慢雾资安长 23pds 随后也发推指出，Four.Meme 遭骇客攻击，损失约 12 万美元，所有合约均未出现漏洞。根本原因是 Four.Meme 向 PancakeSwap 添加流动性的交易外泄，骇客不知道用什么捆绑了本应是私密的启动交易，从而实现夹层操作。
Fourmeme was hacked for ~$120K. None of the contracts was vulnerable. The root cause is the launch (add liquidity to pancakeswap) tx got leaked. The hacker managed to sandwich by bundling with the launch tx, which was supposed to be private.@cz_binance whats going on… https://t.co/8S7tN6mEeF pic.twitter.com/HqmzCw4RTR
— Chaofan Shou (svm/acc) (@shoucccc) March 18, 2025
根据慢雾进一步分析，攻击者的手法是，在 Four.meme 的多个新代币正式发行前，通过 0x7f79f6df 函数购买少量代币，并利用该功能将代币发送到一个尚未创建的 PancakeSwap 交易对地址。
这使得攻击者能在不需要额外转移新代币的情况下，直接创建交易对，并添加流动性，从而绕过 Four.meme 代币发行前适用的转帐限制（MODE_TRANSFER_RESTRICTED），最终攻击者得以在非预期的价格范围内添加流动性，进而窃取池内流动性资金。
?SlowMist Security Alert?
The attacker purchased a small amount of tokens before launch through the 0x7f79f6df function of @four_meme_, and used this feature to send tokens to a specified PancakeSwap Pair address that had not yet been created.
This allowed the attacker to… https://t.co/hyXyKcc2Oq pic.twitter.com/Tjgz9tvuw8
— SlowMist (@SlowMist_Team) March 18, 2025
据派盾监测，Four.Meme 骇客已窃取约 200 枚 BNB，约价值 13 万美元，并将资金转移到去中心化交易所 FixedFloat 。
#PeckShieldAlert Four[.]Meme @four_meme_ has suffered an attack. The hacker has already stolen ~200 $BNB (~worth 130K) and transferred the funds to #FixedFloathttps://t.co/SOy2lYdIjz pic.twitter.com/UslMa8cg7t
— PeckShieldAlert (@PeckShieldAlert) March 18, 2025
Four.Meme 证实遭骇、将全额赔偿受害者
Four.Meme 稍早发声明证实遭受攻击，已暂停 Launch 功能，进行紧急调查，将对受影响用户进行补偿，并提供损失提交表单，以收集相关资讯：
我们将全额补偿受影响用户的损失。验证过程完成后，将在本周内发放赔偿金。
Additionally, we will fully compensate affected users for their losses. Once the verification process is complete, compensation will be issued within this week.
— Four.Meme (@four_meme_) March 18, 2025
