The Web3 security firm HashDit has issued an alert regarding AlphaBot, a trending bot associated with the Binance Alpha Points system. The bot facilitates trading through the Binance Router to increase asset trade volume and balance, earning users more points. However, HashDit has identified a centralization risk due to the bot's reliance on swapRoleMap roles, which could pose a security threat if compromised.
The bot's key function, swapTo, uses TokenWithFee variables for fee calculations without limits, making it vulnerable to exploitation. Since this function can be invoked externally without fee restrictions, and allowances and activeTimeStampMap can be set indefinitely, there is a significant risk if the swapRoleMap is compromised or becomes malicious.
HashDit recommends users set reasonable allowance thresholds for any decentralized applications (DApps) and revoke them when no longer needed. Users are advised never to share their private keys with any tools and to validate tools through trusted platforms like CoinMarketCap. Additionally, testing new tools with a new wallet and limited funds is encouraged to ensure safety.
