Drips Network, a decentralized tipping protocol, was attacked and lost about 24,900 DAI, according to SlowMist monitoring. According to Foresight News, SlowMist’s analysis attributed the incident to an integer type conversion flaw in the DaiDripsHub contract.
SlowMist said the issue involved the give(address,uint128) function, which converts a uint128 amount to int128 without verifying whether the input exceeds the maximum value of int128. The attacker reportedly supplied a value outside the int128 range, causing the converted amount to become negative.
SlowMist said this negative value reversed the transfer direction, leading the reserve contract to execute abnormal withdrawals to the attacker’s account. The withdrawals ultimately depleted the reserve funds.