Statement regarding: dividend distribution vulnerability in our contract

Wed. 1st Dec. 2021 Project updates

We just wanted to take a moment and provide everyone with an update on the withdrawals/reinvesting issue.

At approximately midnight EST last night, an attacker found a vulnerability in our dividend distribution contract. He used a proxy contract to buy 50 BNB worth of KOJI and sell it in the same transaction, draining about 12 BNB out of the distributor. The attacker used the fact that our withdrawal() function was public to conduct this exploit.

This was our fault, an oversight when we migrated the contract, which by the way our contract auditor missed as well. This allowed him to bypass the non-reentrant modifier on the withdraw function, enabling him to loop thru the withdrawal function multiple times, and each time extracting .11 BNB until there was less than 1 BNB left in the distributor.

Here is what is important: the liquidity pool is safe, all team funds are safu and in the end we only lost a net of around ~5 BNB total.

Here is the breakdown of what happened:

  • Attacker used a proxy contract to interface with the pancake pool/distributor directly
  • 50 BNB buy bought 15B KOJI, which gave him a dividend of .11 BNB
  • Using a loop, we think he was able to call the dividend withdraw function around 150 times for .11 BNB
  • Then he sold all the KOJI back, but not before paying 7 BNB in taxes to our charity, admin, and the LP (2.34 BNB each). A total of 16 BNB was taken from the distributor, 4.8 of which came from his transaction alone
  • 16 minus 4.8 = 11.2 minus the 7 BNB he paid in taxes = somewhere between 4 and 5 BNB (we don’t know exactly how much was in the distributor before the attack, but it was somewhere around 12 BNB)

We have since disabled deposits on the distributor, those taxes are now being held in the token contract where they are safe.

Next steps:

Ultimately, we are going to need to migrate to a new token contract in order to restart dividends. We though we could feed the distributor 1 BNB at a time, but the contract doesn’t know the BNB is in there. We could issue a new distributor contract, but then we would have to manually sweep the BNB from taxes over to that contract in order to pay dividends or allow people to reinvest.

The only real solution is to do a token swap, since half our liquidity is locked for 6 months.

So here is our plan of action:

  1. You can trade KOJI as you normally would, however you will not see your dividends increase. We are using those taxes to make everyone whole when we do the token swap
  2. All liquidity is safe, however half is locked for a while
  3. We will build a token swap contract, where you will be able to collect any pending dividends and swap your v1 KOJI to v2
  4. Once we have the majority of v1 KOJI, we will migrate the v2 contract with the 50% of LP that unlocks in 15 days
  5. We will then use the v1 tokens to extract as much liquid out of the old pool and add it to the new pool
  6. Everyone will get the same amount of tokens, all dividends will be received, and we can continue growing the project once this is behind us

We apologize for this oversight. If the attacker would have contacted us, we could have given him a bounty, but he chose to be petty for a few thousand dollars.

Our v2 contract will have better security measures, to be disclosed at a later time.

Please feel free to ask any questions. We wanted to find a way to fix this behind the scenes, however there are no good options. We want to be as transparent with our community as possible and not keep you guys in the dark anymore.

But we felt it was better to get a full scope of the problem/solution before letting everyone know hopefully preventing panic and FUD along the way. We thank your for your patience and hope you will stick with us during this time.

We will be conducting a live community chat in our Telegram on Dec 1st at 21:00 UTC (4PM/16:00 EST) to answer any questions you may have.

The KOJI team

More news & updates:

Fri. 21st Jan. 2022 Promos

Weekend Giveaway, buy KOJI & get CAKE + Dynamic Discount: ON

This weekend we are turning on Dynamic Discount & giving away CAKE to random buyers of KOJI The promotion will run from 5PM Friday 21st January to Sunday 23rd January midnight (times in EST). To enter the competition all you need to do is make a KOJI buy and at the end of the competition we will...
Sat. 1st Jan. 2022 Charity & Donations

KOJI is Donating to Turing Trust, giving 120 computers to 6 schools helping 2150 students.

We can only see a short distance ahead, but we can see plenty there that needs to be done. - Alan TuringComputing, Machinery and Intelligence; 1950 The Turing Trust supports schools in sub-Saharan Africa by reusing computers to set up computer labs, teacher training & software. The Turing Trust...
Sat. 1st Jan. 2022 Promos

The KOJI New Year Weekend Giveaway with Dynamic Discount & Extra Dividends!

The KOJI New Year Weekend Giveaway + Dynamic Discount + Extra Dividends! When Saturday 1st January - Sunday 2nd January midnight (times in EST) How does it work? To enter the competition all you need to do is make a KOJI buy and at the end of the competition we will select the winning...
Tue. 21st Dec. 2021 Promos

KOJI Giveaway: Get your buy matched 1:1 + TAX Discount for KOJI & FEG holders

The Holiday KOJI Giveaway Competition + Discount Tokens & Dynamic Discounts What & When From Tuesday 21st December to Sunday 26th December is the Holiday KOJI Giveaway Competition where we will match the winners transactions KOJI buy 1:1. We've also enabled our dynamic TAX discount system...
Mon. 20th Dec. 2021 Project updates

Dynamic Tax, Dividends Donation & Partner Tokens! New KOJI v2 dApp & Contract Features

New features of KOJI v2 Contract! KOJI v1 brought new features: BNB distribution, dApp function, etc... now in v2, we have 2 new additions: Partner Tokens & Dynamic Discounts Partner Token, we can choose any other BSC token and if you hold a certain amount of that token, it gives you a tax...
Fri. 17th Dec. 2021 Project updates

KOJI v2 now live & trading on Pancakeswap

We are excited to announce that we have launched KOJI V2 and contract is now live on Pancakeswap with 375 BNB in liquidity! 0x7eb567F5c781EE8e47C7100DC5046955503fc26A Buy on Pancakeswap v1 to v2 Swap: Remember, If you have not already, please swap your v1 BSC KOJI to v2. Instructions...
Mon. 13th Dec. 2021 Project updates

Token Swap & New Contract Is Ready! Time to Swap your KOJI v1 to KOJI v2!

Thanks to all our patient community, the KOJI v2 Token Swap is now ready! We would like to extend a thanks to all our KOJI holders for your patience during this slightly bump in our road. We've been hard at work and the new contract is now ready, the dividends distributor vulnerability have been...
Fri. 10th Dec. 2021 Project updates

KOJI Token Swap Information & Update

Hello KOJI holders and community, here is a a quick update on the token swap! We have disabled buying of the v1 KOJI via pancake/flooz until the token swap is ready. This is for the following purposes: 1) People who dumped all their KOJI v1 after the exploit WILL NOT be able to receive their...
Tue. 30th Nov. 2021 Project updates

2nd batch of 25B KOJI have now been burned!

2nd batch of 25B KOJI has now been burned to a current market value of ~$45,000 25,000,000,000 KOJI have been "burned", which means permanently removed from circulation. Tx is below: TX:...
Mon. 29th Nov. 2021 Promos

Congratulation to our “First Contact” NFT Giveaway winners!

Congratulation to the two winners in our NFT Giveaway contest, the winners are: Tier 1 Animated NFT winner: 0xb71bd62e28405d3cfe4078023ee36d87602c5678 Links to Winner TX and NFT transfer TX. Please add contract 0x8e162128edd0ca628f207b7215dcf1d4bc607ee8 and tokenID #108 to your wallet to...
Sat. 27th Nov. 2021 Promos

Congrats to our $KOJI BLACK FRIDAY Trading Competition Winners!

Congrats to the winnersof the buy and reinvest $KOJI Black Friday competitions! Prizes have been sent already. 1 BNB Winner ( for > 0.1 BNB KOJI buy) 0x8061ac739be4df83570143c71ef005b8b5d8230d, who bought 1 BNB worth of KOJI, a 100% refund! Links to Buy TX and Prize TX 0.5 BNB Winner...
Thu. 25th Nov. 2021 Promos

Weekend of promotions! Trading Contest, NFT Giveaway & another Burn

We have some exciting events coming up for our community this weekend, starting on Black Friday and going all the way up to Sunday at midnight. So right after stuffing yourself for Thanksgiving (if you celebrate that sort of thing), get ready for the real festivities to begin! November 26,...