WINR Hack

WINR Protocol is the on-chain gambling protocol behind the JustBet casino, which started on Arbitrum. Its MixedSwapRouter was a contract for swapping tokens through exchange pools, and wallets approved it so it could move their tokens during a swap. The router had a flaw: when a pool asked to be paid during a swap, the router took the paying wallet's address from the request itself and never checked that the request came from a genuine pool.

On 31 May 2024, an attacker set up a fake pool and used it to send the router payment requests naming wallets that had approved the router as the payer. The router then took tokens from those wallets and handed them to the attacker. About 293k WINR tokens, worth around $11k at the time, were taken. The security firm ChainAegis flagged the attack the same day and urged people to revoke their approvals to the router.

The amount lost was small, but the router has not been changed since the attack, so the flaw is still there and any approval still given to it can be used to take the approved tokens. WINR later launched JustBet on its own blockchain, WINR Chain, in September 2024, but the router remains on Arbitrum. If you ever approved the WINR MixedSwapRouter, revoke that approval. Revoking protects what is still in your wallet but does not recover lost tokens.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.