SlowMist раскрыла уязвимость в смарт-контракте KiloEx

cryptonews.ruPublished on 2025-03-15Last updated on 2025-04-15

Аналитики SlowMist установили, что причиной взлома проекта KiloEx стала критическая ошибка в контракте MinimalForwarder. Отсутствие базовой проверки доступа позволило злоумышленнику манипулировать ценами через цепочку вызовов смарт-контрактов. В частности, execute-функция дала возможность подменить адрес и подпись, пройти проверку и «вызвать нужные методы без ограничений». Это открыло путь к изменению ценового оракула и последующему извлечению прибыли. В результате хакеры похитили около $7 млн

Исследователи SlowMist подробно описали цепочку вызовов, приведших к атаке. Сначала злоумышленник получил возможность вызвать функцию setPrices в контракте KiloPriceFeed, которая используется для обновления данных о ценах. Это стало возможным благодаря некорректной архитектуре вызовов между контрактами Keeper, PositionKeeper и MinimalForwarder. Уязвимость в последнем позволила передавать любые параметры и обойти проверку данных. В результате, злоумышленник сначала занизил цену и открыл длинную позицию, а затем резко поднял курс и закрыл ее с прибылью.

Представители KiloEx подтвердили факт эксплойта и сообщили, что работают над расследованием совместно с BNB Chain, Manta Network и ведущими компаниями по безопасности, включая Seal-911, SlowMist и Sherlock. Команда отметила, что инцидент затронул несколько экосистем, и ведется активная работа по отслеживанию и возврату украденных криптовалют. Также стало известно, что средства злоумышленника начали перемещаться через протоколы zkBridge и Meson.

Случай с KiloEx снова подчеркнул важность базовых проверок доступа в смарт-контрактах. Ошибка в одном компоненте системы привела к полной компрометации логики торговли и серьезным убыткам. Эксперты призывают команды DeFi-проектов уделять больше внимания безопасности на уровне архитектуры, особенно при использовании контрактов для делегированных вызовов.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Best Meme Coin to Buy in 2026: MemeToro Brings AI Agents and BNB Chain Infrastructure Together

The article discusses the search for promising meme coins in 2026, highlighting a shift toward projects with practical infrastructure. While projects like DOGE, SHIB, and PENGU focus on liquidity, utility, or consumer IP, a new contender, MemeToro ($MT), takes a different approach. It combines AI agents with the BNB Chain's low-cost, high-speed infrastructure. MemeToro's core proposition is to build an ecosystem where AI supports memecoin discovery, validation, and launches. Its AI agents monitor market trends to identify emerging opportunities and validate smart contracts for security risks. This functionality is built on the BNB Chain, chosen for its suitability for frequent, low-cost transactions typical in memecoin trading. By focusing on infrastructure rather than trying to become the next viral token itself, MemeToro aims to benefit from the broader growth of the AI-assisted memecoin sector. The project is currently in Stage 6 of its presale.

bitcoinist7m ago

Best Meme Coin to Buy in 2026: MemeToro Brings AI Agents and BNB Chain Infrastructure Together

bitcoinist7m ago

TON Validators Prepare Node Update Ahead Of Collator Vote

TON validators have been instructed to update their node software and mytonctrl tool in preparation for a configuration vote on August 21 at 08:00 UTC. This vote is tied to activating the network's new collator architecture, which aims to improve block production and scalability. The article emphasizes that this is a preparatory and voting-stage process; it should not be described as full collator activation until the vote finalizes and the switch is complete. Validator coordination is critical to avoid network delays, and while such infrastructure upgrades are mostly invisible to users, they are essential for TON's high-throughput ambitions and scaling within the Telegram ecosystem. The next step is to monitor the vote outcome and subsequent implementation.

bitcoinist12m ago

TON Validators Prepare Node Update Ahead Of Collator Vote

bitcoinist12m ago

EIP-8363 Quantitative Review: Cutting Staking 'Subsidies' – What Does Ethereum Hope to Gain?

**EIP-8363 Quantitative Review: Reducing Staking "Subsidies" – What Does Ethereum Want in Return?** EIP-8363 proposes burning an increasing portion of validator rewards as the staking rate rises, reaching 100% burn when 50% of ETH is staked. This analysis models its impact on issuance, yield, and staking equilibrium, examines whether ETH's yield explains its price, quantifies the chain economy's reliance on this yield, and presents conclusions. Key findings: 1. **EIP-1559 Burns Are Ineffective:** Post-merge, burning (via base fees) has collapsed by 98% and now offsets only 2.4% of new ETH issuance, making issuance policy Ethereum's sole remaining supply lever. 2. **EIP-8363's Real Impact:** At the current ~42.2M ETH staked, the proposal would cut issuance by ~58.6% and staking APR by ~56.4%, removing ~633k ETH ($1.55B) in annual dilution (0.53% of market cap). It's not zero issuance; that would require 43% more ETH staked. 3. **Self-Limiting Mechanism:** The design has a built-in equilibrium. At reasonable required returns (e.g., 2%), the system stabilizes at ~26% staking rate and ~0.48% annual inflation. 4. **Yield vs. Price:** No detectable statistical relationship exists between changes in staking yield and ETH price returns over 43 months. The natural 37% yield decline since 2023 did not drive price action. 5. **Chain Economy Dependence:** While LSTs like wstETH form ~34% of collateral in major lending markets, their utility as collateral remains if yield is positive. The direct revenue hit to protocols like Lido is significant (~50% of fee income) but not systemic. Staking-focused ETFs represent only 0.19% of ETH supply. 6. **Core Conflict:** The debate masks a zero-sum redistribution: cutting ~$1.55B in annual issuance transfers value from concentrated staking intermediaries (LST/LRT protocols, leverage players) to the dispersed majority of non-staking ETH holders. 7. **Outlook:** The proposal is economically sound for ETH's scarcity but politically difficult due to concentrated opposition. It is unlikely to pass in its current form.

marsbit16m ago

EIP-8363 Quantitative Review: Cutting Staking 'Subsidies' – What Does Ethereum Hope to Gain?

marsbit16m ago

Avalanche Tokenized Asset Value Crosses $3B As RWA Push Grows

Avalanche's tokenized real-world asset (RWA) value has surpassed $3 billion, marking a key milestone in its strategy to become institutional financial infrastructure. The aggregate value was significantly boosted by Progmat's $1.2 billion securities migration, with OpenTrade and Grove Finance contributing approximately $190 million and $260 million respectively. RWAs represent a major institutional use case for blockchain, involving assets like Treasuries and securities. For Avalanche, this growth strengthens its narrative as a platform for regulated asset issuance and settlement, aligning with its focus on subnets and custom deployments for institutional needs. While the $3 billion figure is substantial, it reflects total on-chain value, not new daily inflows or a direct catalyst for AVAX price. The milestone's long-term significance hinges on whether these tokenized assets drive active usage, trading, and settlement volume on the network.

bitcoinist17m ago

Avalanche Tokenized Asset Value Crosses $3B As RWA Push Grows

bitcoinist17m ago

Aave Debt Concentration Raises Risk Questions After Ethereum Volatility

Following Ethereum's volatility, a risk assessment reveals that less than 9% of loan positions on the Aave lending protocol account for roughly half of its total outstanding debt. This concentration is primarily linked to leveraged E-mode positions involving WETH borrows backed by liquid-staking derivatives. The concern is not current insolvency or liquidations, but that such correlated exposure makes the protocol more sensitive to sharp ETH price moves, particularly on the downside. While Aave's E-mode feature enables efficient borrowing for correlated assets like ETH and stETH, it also increases leverage and potential fragility during market stress. The report emphasizes that this highlights a concentration and correlation risk for the decentralized protocol, not a failure, but a scenario that governance and risk managers may monitor for potential parameter adjustments.

bitcoinist22m ago

Aave Debt Concentration Raises Risk Questions After Ethereum Volatility