On March 20th, Gala Games, a prominent GameFi project, announced that it had filed a lawsuit against pNetwork, the cross-chain interoperability bridge employed by Gala on the BNB Smart Chain. The lawsuit arises from an incident in November 2022, when an unauthorized wallet address minted over $2 billion in GALA tokens and subsequently dumped them on PancakeSwap. This action drained $4.5 million from the liquidity pool and resulted in a significant drop in GALA's token price.
Gala Games alleges that the exploit was due to "negligence and tortious interference" on pNetwork's part. According to a November 7, 2022 report from blockchain analytics platform SlowMist, the exploit may have been caused by a plain text private key leak in one of three pNetwork-affiliated smart contracts on Gala. The leaked private key was reportedly visible on GitHub.
The lawsuit claims that pNetwork admitted to accidentally leaking a governance key during the deployment of the pGALA bridge. This key was later used by an attacker to breach the pGALA contract on the BNB chain. In response to the lawsuit, a pNetwork representative expressed surprise and concern, stating that they had submitted a comprehensive report to the Swiss authorities three months ago, detailing the entire incident.
The representative also mentioned that the report included full conversations and relevant documentation, and alleged that the Gala Games team deleted messages related to "their role in planning, supporting, and communicating the so-called white hat intervention." pNetwork maintains that they have been fully transparent and cooperative with the authorities, and believe that the truth will eventually come to light.
Gala Games is seeking $27.7 million from pNetwork for damages, additional compensation for injuries, punitive damages, and other relief. If the lawsuit is successful, Gala has stated that any damages, minus legal fees, will be converted to $GALA and burned. They also encourage other affected parties to contact the legal team.
In a November 5, 2022 post-mortem analysis, pNetwork acknowledged a misconfiguration of the pNetwork-powered bridge for the GALA token, which led to the loss of ownership over the pGALA smart contract. They also claimed that no hack was performed by the attacker, but the situation presented a high security risk that needed to be addressed promptly.
Gala Games alleges that pNetwork had initially planned to return the BNB assets collected from the "whitehat draining of the pool" in full but did not follow through with the plan. pNetwork stated that the first part of its recovery plan involving GALA tokens has been completed, but the second part involving BNB tokens is still on hold.
None of the allegations have been proven in court, and pNetwork has pledged to continue working closely with Swiss authorities to resolve the issue in the best interests of all parties involved.