The team behind Cashio, a Solana-based dApp that was hacked last week, published a postmortem report on the attack. In one of the biggest hacks on this network, the bad actors managed to steal $50 million by exploiting a vulnerability on the dApp.
As Bitcoinist reported, to use Cashio, users need to mint CASH by making SABER deposits on the USDT-USDC pool. Saber operates as a cross-chain AMM for Solana-based stablecoins.
The bad actor apparently exploited a point of failure on Cashio’s account validation system. This security component was incomplete and enable the bad actor to create multiple accounts.
The report from Saber Labs records an increase in activity for the CASH pools. Thus, there was more capital locked on Cashio than usual, probably making it more attractive for the bad actors.
The team at Saber Labs claimed it took measures to prevent something similar from happening in the future. In particular, they will be more transparent with their code reviewing and auditing process.
Any product on the Saber ecosystem, they announced, will be reviewed to guarantee the safety of the funds. This measure will not apply to closed source protocol which, Saber Labs believes, “have the benefit of being much harder to hack”.
Saber Labs apologized for the attack on its users. They claimed to lack the funds to “payback depositors”, or to economically amend this “catastrophic” event to Saber users.
The team made the following announcement in an attempt to revert a situation that they believe could negatively impact its users:
If you are the hacker and are reading this, we hope you will consider returning the funds rather than donating them to charity: accounts with over $100k are often users’ life savings on leverage, and many of us will seriously be affected financially after this incident. We are willing to give $1M of USDC as a bounty if the funds are returned.
Solana dApp Hacker Pulls A Robinhood
This plead was apparently listened to and replied to for the benefit of Cashio users. According to a pseudonym user, the bad actors decided to return the funds to those with accounts that lost under $100,000 in CASH.
In order to get their funds back, users need to access the following link. This will lead them to an open-source platform created to receive refunds submissions.
The creator of this website published the Github link to the open-source code that supports the refund submission platform. Thus, anyone can verify its authenticity and should check for any potential vulnerabilities or malicious code.
The attacker or attacker left the following message on their actions:
The intention (with the Cashio hack) was only to take money from those who do not need it, not from those who do. Will be using the th gains to return more funds to those affected, even some accounts more than 100k. Will not return funds to accounts that already receive refund.
The attacker made several demands, including potential leaders for the organization backing the Solana dApp.
Thanks @wireless_anon for setting this up. We have deployed the same code at https://t.co/i4KtrqfB8E
We will send out a tutorial on how to use this and how to verify you entered everything correctly soon, as well as more information on how to submit the signatures to us after. https://t.co/RncwVBCmfE
— Cashio ($CASH) 💵 (@CashioApp) March 28, 2022
At the time of writing, Solana (SOL) trades at $112 with a 1% profit on the 4-hour chart.
SOL with moderate profits on the 4-hour chart. Source: SOLUSDT Tradingview
