Inverse Finance被盗1450万美元事件分析

CertikPublished on 2022-04-03Last updated on 2022-04-03

Abstract

该事件发生的根本原因在于外部价格预言机依赖导致价格被操纵，因此攻击者可通过操纵价格来借用资产。

北京时间2022年4月2日19时，CertiK安全技术团队监测到Inverse Finance被恶意利用，导致价值约1450万美元的资产受到损失。
该事件发生的根本原因在于外部价格预言机依赖导致价格被操纵，因此攻击者可通过操纵价格来借用资产。
攻击流程
在发起攻击之前，攻击者做了如下准备:
1. 首先，攻击者部署了一个恶意合约。该合约地址为：0xea0c959bbb7476ddd6cd4204bdee82b790aa1562
2. 其次，攻击者在SushiSwap/Curve.fi中进行调换，以操纵交易中的价格，该交易地址为：0x20a6dcff06a791a7f8be9f423053ce8caee3f9eecc31df32445fc98d4ccd8365
由于SushiSwap:INV（INV-ETH Pair）的流动性非常低，用300ETH（价值约一百多万美元）换取INV将大幅增加INV价格。
随后，攻击者正式发起攻击:
1. 攻击者把在准备阶段获得的INV存入，并铸造（mint）了1746枚XINV代币。
2. XINV的价格计算：根据SushiSwap:INV对中的INV价格所计算。如上所述，INV的价格被操纵，因此每XINV的价值为20926美元。
3. 随着XINV的价格被修改，攻击者能够用铸造的XINV代币借用到如下资产：1588枚ETH，94枚WBTC，3999669枚DOLA与39枚YFI。
合约漏洞分析
该漏洞主要原因是对价格预言机具有依赖性，并且这中间有30分钟的窗口期。而攻击在准备阶段完成后正式发生，仅仅用了15秒。

在这种情况下，因为timeElapsed == 15，预言机合约Keep3rV2Oracle的函数_update()中'timeElapsed > periodSize'的检查将被绕过。这意味着最后的累积价格还没有被更新。由此可见，函数_computeAmountOut()中的amoutOut会比预期的数额大，因为priceCumulative已经被操纵了，但_observation.priceCumulative没有被更新。

一方面，XINV的价格依赖于SushiSwap:INV 对（INV-ETH对）的储备，其流动性非常低。
另一方面，TWAP可以防止闪电贷攻击。理论上，攻击者能够通过 "牺牲 "一些钱来操纵价格，也就是说，用他自己的钱来改变价格。在这个特殊的价格预言机设计中，如果经过的时间没有超过30分钟，当前的价格（来自储备金）不应该被用来计算出金金额。
资产追踪
据CertiK SkyTrace显示，价值约1450万美元的资产被盗后已被转移到Tornado Cash。

其他细节
利用漏洞进行交易的准备期间:
https://etherscan.io/tx/0x20a6dcff06a791a7f8be9f423053ce8caee3f9eecc31df32445fc98d4ccd8365
利用漏洞进行交易发起攻击:
https://etherscan.io/tx/0x600373f6752132https://etherscan.io/tx/0x600373f67521324c8068cfd025f121a0843d57ec813411661b07edc5ff781842
攻击者地址1:https://etherscan.io/address/0x117c0391b3483e32aa665b5ecb2cc539669ea7e9
攻击者地址2: https://etherscan.io/address/0x8b4c1083cd6aef062298e1fa900df9832c8351b3
攻击合约:
https://etherscan.io/address/0xea0c959bbb7476ddd6cd4204bdee82b790aa1562
预言机合约:
https://etherscan.io/address/0x39b1df026010b5aea781f90542ee19e900f2db15#code
SushiSwap INV-ETH Pair:
https://etherscan.io/address/0x328dfd0139e26cb0fef7b0742b49b0fe4325f821
XINV 合约地址: https://etherscan.io/address/0x1637e4e9941d55703a7a5e7807d6ada3f7dcd61b#code
Keep3rV2 预言机合约地址:
https://etherscan.io/address/0x39b1df026010b5aea781f90542ee19e900f2db15#code
写在最后
现如今，很多项目都会用到预言机，部分项目还会对其具有很强的依赖性。安全审计，会审查预言机的设计合理性、价格算法以及经济模型等。
因此，CertiK的安全专家建议：尽量避免使用流动性低的池子作为价格预言机价格来源，同时对项目进行安全审计从而保证预言机模型的正确性。

Miners Advised Not to Buy GPUs for AI and to Focus on Infrastructure

A founder at an energy investment forum advises bitcoin miners not to purchase GPUs for AI themselves, but to instead focus on infrastructure like power and data center space. Mike Alfred of Alpine Fox stated that while AI infrastructure demand is a long-term, 20-30 year trend, it presents a key choice for miners. The first, riskier model involves owning and operating GPUs, which requires financing expensive hardware that quickly becomes obsolete. The second, more conservative model is akin to real estate: providing colocation services where clients bring their own servers, and the miner sells space, power, cooling, and water. Alfred noted this model is easier to finance. Most existing bitcoin mining sites are difficult and expensive to convert for AI, as AI data centers require far higher construction costs, redundant fiber connections, backup power, complex cooling, and near 100% uptime. A hybrid model, where mining acts as a flexible load to use excess power during AI data center construction or from generation facilities, was discussed. However, participants concluded this is only viable with very cheap power; otherwise, developers are better off focusing solely on AI. Miners are increasingly being evaluated for their available power capacity and project portfolios rather than just bitcoin output. Panelists also warned of risks in the AI sector, predicting at least one major default or contract breach among AI tenants, lenders, or landlords before bitcoin's next halving in 2028.

cryptonews.ru7m ago

Miners Advised Not to Buy GPUs for AI and to Focus on Infrastructure

cryptonews.ru7m ago

Millisecond 'Pay-to-Cut': How Did Hyperliquid's Priority Fee Turn into a Multi-Million Dollar Business?

"Millisecond 'Paid Queue-Jumping': How Hyperliquid's Priority Fee Became a Multi-Million Dollar Annual Business" In traditional finance, high-frequency trading firms spend millions on infrastructure for millisecond advantages. Hyperliquid has translated this race onto the blockchain with its "Priority Fee" system, creating an open economic game for speed. This system auctions two types of priority: **Gossip Priority** for faster data feeds (via a Dutch auction every 3 minutes), and **Order Priority** for front-of-queue trade execution (users bid a fee for lower latency). This converts a hardware race into a transparent, market-priced mechanism. Since launch, this feature has generated over $5M in protocol revenue. Projected annualized buybacks from this income exceed $30M, accounting for ~7% of total protocol revenue. The demand stems from large traders and market makers on Hyperliquid, for whom milliseconds can mean the difference between profit/loss or avoiding liquidation. Market makers pay these fees as "protection" to ensure their orders execute first, which in turn improves liquidity for all users. Crucially, Hyperliquid internalizes Maximum Extractable Value (MEV) that typically leaks to external validators or searchers, creating a new revenue stream beyond trading fees. The mechanism also strengthens HYPE's tokenomics. While 97% of trading fees fund secondary market buybacks (via the Assistance Fund), Priority Fees are **directly burned**, adding a second deflationary engine. Furthermore, fees for order priority are deducted from users' undelegated HYPE balances, encouraging large traders to hold and lock up tokens, reducing circulating supply. However, a key challenge remains: balancing the speed needs of institutional players with fair market access for retail users, as those who cannot pay high fees may suffer worse slippage during volatility. In summary, Hyperliquid's Priority Fee is a novel model that monetizes latency, captures MEV for the protocol, and enhances its native token's value through burning and lock-ups.

marsbit13m ago

Millisecond 'Pay-to-Cut': How Did Hyperliquid's Priority Fee Turn into a Multi-Million Dollar Business?

marsbit13m ago

Jito Seizes User Traffic with JTX, Why Is It Still Undervalued by the Market?

Jito, a Solana infrastructure provider, has launched a new product called JTX, which is shifting its business model from being a price-taker on Solana block space to becoming a price-setter for user transaction flow. Despite this strategic shift aimed at capturing and monetizing user traffic, the market continues to undervalue its native token, JTO. Analysts present a valuation case for JTO, arguing the market still prices it as backend infrastructure. Their base case scenario assumes JTX captures 15% of Solana DEX volume by Q2 2027, generating significant annualized revenue. Applying a conservative 30x P/S multiple to this revenue implies a JTO price of $1.18, representing ~57% upside from current levels (~$0.75). A probability-weighted target, including bullish (40% probability, 25% market share) and bearish (10% probability, 5% share) scenarios, points to a target of $2.75, suggesting ~267% potential upside. The thesis hinges on JTX's early positive performance data and its potential to benefit from the expected growth of on-chain trading, particularly from tokenized stocks and real-world assets. Furthermore, an estimated 80% of JTX's net revenue is slated for JTO buybacks, creating a potential value-accrual flywheel. The report concludes that Jito's transformation via JTX is not yet reflected in its valuation.

marsbit25m ago

Jito Seizes User Traffic with JTX, Why Is It Still Undervalued by the Market?

marsbit25m ago

The Truth Behind Digital Banking: The Fragile Ecosystem Supporting 1.46 Billion Users

The article "The Truth About Digital Banks: The Fragile Ecosystem Behind 1.46 Billion Users" provides a data-driven analysis of the digital banking sector based on a verified list of 368 active neobanks as of July 2026. While these platforms collectively serve 1.46 billion users, with Asia (817 million users) and institutions like WeBank and Nubank dominating the landscape, the sector faces significant structural vulnerabilities. A key finding is that only 127 of the 368 neobanks hold full banking licenses. The majority operate atop third-party infrastructure providers like Banking-as-a-Service (BaaS) platforms, creating systemic risk where the failure of a single provider, as seen in past cases like Wirecard and Synapse, can jeopardize multiple consumer brands. Furthermore, the industry experiences a steady, quiet stream of failures, mergers, and shutdowns that often go unreported. The analysis also examines the adoption of artificial intelligence (AI), finding only 67 platforms (18%) have deployed AI at scale, with many innovators based in emerging markets like Nigeria and the Philippines. The infrastructure layer is highly concentrated, with 106 providers supporting the entire ecosystem of 368 consumer-facing brands. The article concludes with three predictions: the unlicensed gap will close through acquisitions or exits; an AI credit model is likely to fail in the next economic downturn; and a nascent but significant trend is the emergence of financial services designed for AI agents rather than humans.

marsbit28m ago

The Truth Behind Digital Banking: The Fragile Ecosystem Supporting 1.46 Billion Users

marsbit28m ago

Digital Asset Trading Platform Uphold Cuts 17% of Global Workforce Amid 'Crypto Winter'

Cryptocurrency trading platform Uphold has laid off approximately 17% of its global workforce, affecting 85 full-time employees and contractors. The cuts are part of a strategic shift to reallocate resources towards its rapidly growing corporate services business, as retail cryptocurrency trading activity has declined amid the ongoing market downturn. CEO Simon McLaughlin stated the company is restructuring after years of significant growth and remains confident in the long-term prospects of digital assets and blockchain technology. Founded in 2015, Uphold offers trading and custody services for cryptocurrencies, fiat, stocks, and precious metals. It has recently expanded to provide infrastructure for banks, fintech firms, and broker-dealers to integrate crypto services. The layoffs occur against a backdrop of a prolonged crypto market slump, with total market capitalization falling to around $2.1 trillion by Q2 2024. Factors include weakened trading volumes, reduced retail participation, interest rate hikes, geopolitical uncertainty, and net outflows from U.S. spot Bitcoin ETFs. Uphold clarified it is not shutting down its UK operations or any international offices. The company highlighted strong growth in its corporate platform and announced plans to evolve its consumer app into a broader blockchain-based financial assistant by 2026, offering U.S. stocks, tokenized securities, lending, credit cards, and DeFi yield opportunities.

cryptonews.ru28m ago

Trading

Spot