# TempleDAO's STAX Contract Hack Investigation
## Exploit overview
On October 11, 2022 the DeFi protocol TempleDAO was exploited. About $2,3M worth of funds were withdrawn from the platform contract at that time. The amount is 4% of the total amount of funds involved in the TempleDAO. The attacker then moved the funds to [TornadoCash](https://www.coindesk.com/tech/2022/10/17/templedao-exploiter-moves-ether-worth-over-25m-to-tornado-cash/).
Here is the invocation flow of the transaction
The account of a hacker was linked to Binance as per [this tweet](https://twitter.com/officer_cia/status/1579843881050730499).
## What happened?
As it can be observed at the invocation flow the attacker used the privileged *migrateStake* function to gain access to the funds that he was not supposed to.
321154 *xLP* tokens were withdrawn from the *xLP Staking contract.* Then xLP tokens were swapped for *$TEMPLE* and *$FRAX* tokens. *$TEMPLE* tokens were then sold for *$FRAX* tokens. As the result hacker ended up with *$FRAX* tokens which then were moved to TornadoCash in multiple transactions.
Watch transaction history of this address for exact transaction details
## The root of the problem
**Smart-contract programmers mistake.** In Solidity programming language there are function modifiers that define access restrictions in most cases.
As it is shown on the code snipped above there is an “onlyOwner” modifier on a privileged function which defines that only special account with “owner” privileges can use this function.
The same access restriction modifier should have been used on *migrateStake()* function. However the smart-contract developer forgot to add it.
## Conclusions
It can be concluded that the contract was not properly tested and the code review was not conducted.
The issue was very easy to avoid if even a junior-level solidity developer would have to review the code before deployment.
The issue could be fixed easily by just adding the modifier before code deployment.
