Эксперты Beosin изучили атаку на Pendle Penpie

cryptonews.ruPublicado a 2022-06-04Actualizado a 2024-09-04

По данным на 4 сентября 2024 года DeFi-протокол Penpie, построенный на базе Pendle Finance, стал жертвой хакерской атаки, в результате которой было похищено около $27 млн в криптовалюте. Сразу после инцидента команда безопасности Beosin провела собственный анализ произошедшего и выявила ключевые уязвимости, которые позволили злоумышленникам успешно осуществить атаку.

Penpie — это платформа DeFi, интегрированная с Pendle Finance, которая предоставляет пользователям возможность блокировать токены PENDLE для получения прав управления и увеличения доходности в рамках экосистемы. Цель площадки заключается в улучшении доходности для клиентов и предоставлении услуг по усилению veTokenomics.

Атака была проведена с использованием уязвимости функции reentrant в контракте вознаграждений, что позволило злоумышленнику манипулировать балансом стейкингового контракта и получить чрезмерные вознаграждения. Основной этап подготовки атаки включал создание злоумышленником нового рынка и Yield с помощью «фабричного контракта» в протоколе Penpie, где контракт SY был использован в качестве атакующего.

Хакер также воспользовался флэш-займом, чтобы получить необходимую ликвидность для проведения атаки, и инициировал функцию batchHarvestMarketRewards, которая позволила ему управлять балансом рынка и получать неправомерные вознаграждения. В процессе атаки злоумышленник несколько раз повторил эту операцию, увеличивая свою прибыль за счет манипуляций с функцией redeemRewards.

Команда Pendle, узнав о случившемся, незамедлительно приостановила работу контрактов, что позволило предотвратить дальнейшие убытки и сохранить активы на сумму $105 млн. Однако хакеру удалось вывести около $27 млн, из которых 2900 ETH (приблизительно $6,9 млн) уже были переведены в Tornado Cash — сервис, известный своими возможностями по анонимизации транзакций.

В настоящее время Penpie активно пытается связаться с хакером, предлагая ему вознаграждение за возвращение украденных средств. В рамках реагирования на инцидент, команда безопасности Beosin рекомендовала добавить модификаторы для защиты от повторных входов в функции контракта, использовать единый контракт для генерации токенов, а также провести полный аудит безопасности перед запуском проекта.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Criptos en tendencia

CitreaCTR

wrapped stUSDTWSTUSDT

Velodrome FinanceVELODROME

BrevisBREV

ZRX（0X）ZRX

PancakeSwapCAKE

Lecturas Relacionadas

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

"A Short Seller's Dire Prediction: AI Boom Fading, US Stocks to Peak by Q3 with 30-50% Decline" Prominent macro investors Jeffrey Gundlach and Felix Zulauf warn that the AI-driven market rally is nearing its end, forecasting a major US stock market correction of 30-50%, potentially beginning as early as Q3. Their analysis points to alarming parallels with historical market tops, citing extreme concentration in the top AI-related stocks within the S&P 500. Zulauf's bearish thesis hinges on unsustainable capital expenditure trends among major cloud companies, negative free cash flow emergence, and soaring semiconductor prices. Gundlach highlights dangerous parallels to the 1999 tech bubble peak. A key divergence from conventional wisdom is Gundlach's view that long-term Treasury yields will not fall meaningfully even during a recession, due to America's structurally out-of-control fiscal deficits and soaring interest costs. He warns this could force the government into yield curve control or even a sovereign debt restructuring. Both investors express severe concerns about the opaque private credit market, drawing parallels to the pre-2008 financial crisis environment. They allege widespread rating inflation, misrepresented credit quality, liquidity illusions, and fraudulent asset valuations within this sector. The analysis links the AI boom and private credit crisis through financing costs. They argue that as AI companies' cash flows weaken and they seek funding, a high and sticky long-term interest rate environment will severely stress lower-rated corporate borrowers, exposing cracks in credit markets. Finally, they predict a regime shift where the US dollar weakens and US equities underperform global markets, marking the end of their long dominance. The stage is set for a significant market reversal.

marsbitHace 6 min(s)

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

marsbitHace 6 min(s)

Why Does No One Buy DeFi Insurance?

**Title: Why Isn't DeFi Insurance Being Bought?** DeFi insurance, which promised automated, unbiased payouts via smart contracts, has failed to gain traction. The core issue is economic: high premiums severely erode the yields that attract users to DeFi in the first place. For example, insuring a USDC deposit on Aave V3 could cost 1.5–2.5% of the annual yield, leaving a net return barely above a savings account. For riskier platforms like Maple Finance or Ethena, premiums can even turn net yields negative. Consequently, users often forgo insurance, as it nullifies their profit motive. The market also suffers from structural flaws. First, DeFi risks are highly correlated (e.g., an oracle failure can impact multiple protocols simultaneously), unlike the independent risks in traditional insurance. This makes large-scale events potentially catastrophic for insurers. Second, the total capital in DeFi insurance pools (e.g., Nexus Mutual's ~$81.5M) is minuscule compared to the hundreds of billions in total value locked (TVL), creating a massive capacity gap. A single major hack could drain the entire industry's reserves. Furthermore, the governance model where tokenholders vote on claims creates a conflict of interest, incentivizing them to deny payouts to protect their own funds. As a result, the sector is shrinking. While pioneers like Nexus Mutual are pivoting to preventative measures (bug bounties) and seeking external capital via reinsurance, the fundamental problems remain. DeFi insurance represents a public good—its stability benefits the entire ecosystem—but without a mechanism to share costs, a "tragedy of the commons" ensues where no one is willing to pay, leaving the system vulnerable.

marsbitHace 20 min(s)

marsbitHace 20 min(s)

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

SpaceX's share price (SPCX) has fallen sharply, briefly dropping below its $150 IPO price in pre-market trading. The decline follows a catastrophic explosion during a Starship static fire test and was exacerbated by the company's announcement of a planned $20 billion bond issuance. This move, coming soon after its IPO raised $85.7 billion, raised concerns about SpaceX's cash burn rate and AI infrastructure spending surpassing expectations. The sell-off is also tied to a broader global pullback in AI-related stocks, with investors questioning the return on massive capital expenditures. Analysts note the initial IPO surge was largely driven by retail investor frenzy, which has now waned as sentiment turns cautious. With only about 5% of shares currently floating, the market is bracing for significant potential selling pressure when employee lock-up periods expire later this year. While some, like Cathie Wood's ARK Invest, remain long-term bullish on SpaceX's core ventures, other research firms argue the current stock price is driven by narrative rather than fundamentals and that future growth is already priced in. The next potential catalyst is the stock's possible inclusion in the Nasdaq 100 index in July.

Odaily星球日报Hace 21 min(s)

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

Odaily星球日报Hace 21 min(s)

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

**BitMart Research Weekly: Fed Hawkishness Weighs on Crypto, RWA Sector Shows Strength** In traditional markets, US equities were mixed as weakening macro data signaled slowing growth. The Federal Reserve held rates at 3.75%, with half of its officials projecting at least one rate hike this year, adopting a more hawkish stance. The crypto market faced sustained pressure. BTC fell 3.7%, underperforming ETH, which dropped 1.2%. Overall market sentiment remained in "Extreme Fear." US spot Bitcoin ETFs saw net outflows of approximately $226.8 million for the week, indicating a lack of sustained institutional buying. Despite the bearish backdrop, the Real World Assets (RWA) narrative gained traction. XLM surged 12.2%, driven by Stellar's RWA tokenization roadmap. Stablecoin market capitalization stabilized near $315.3B, showing structural shifts towards compliant and institutional cash management tools like USDG and BUIDL. A notable stress point emerged as Strategy's STRC traded below its $100 face value for a fifth consecutive week, pressuring its dividend model and raising questions about its Bitcoin treasury management strategy.

marsbitHace 25 min(s)

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

marsbitHace 25 min(s)

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

Bridgewater founder Ray Dalio links declining U.S. credibility and rising Chinese influence to a modern "tribute system" – a hierarchical order based on power differentials, economic interests, and diplomatic pressure rather than direct control. This shift, he argues, makes U.S. commitments appear negotiable, prompting Asian nations to reassess security and economic alignments. A key market vulnerability is the advanced semiconductor supply chain concentrated in East Asia, which produces the majority of the world's most advanced chips. Dalio suggests that even without direct conflict, uncertainties over commitments, shipping, or supply chain reshoring can trigger asset price volatility in tech stocks, Asian markets, and RMB-denominated assets. While not predicting immediate extreme events, he warns that policy swings, miscalculations, and non-military pressure could reshape regional order, with market reactions preceding any outright confrontation.

marsbitHace 26 min(s)

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

marsbitHace 26 min(s)

Trading

Spot

Futuros

Artículos destacados

Cómo comprar PENDLE

¡Bienvenido a HTX.com! Hemos hecho que comprar Pendle (PENDLE) sea simple y conveniente. Sigue nuestra guía paso a paso para iniciar tu viaje de criptos.Paso 1: crea tu cuenta HTXUtiliza tu correo electrónico o número de teléfono para registrarte y obtener una cuenta gratuita en HTX. Experimenta un proceso de registro sin complicaciones y desbloquea todas las funciones.Obtener mi cuentaPaso 2: ve a Comprar cripto y elige tu método de pagoTarjeta de crédito/débito: usa tu Visa o Mastercard para comprar Pendle (PENDLE) al instante.Saldo: utiliza fondos del saldo de tu cuenta HTX para tradear sin problemas.Terceros: hemos agregado métodos de pago populares como Google Pay y Apple Pay para mejorar la comodidad.P2P: tradear directamente con otros usuarios en HTX.Over-the-Counter (OTC): ofrecemos servicios personalizados y tipos de cambio competitivos para los traders.Paso 3: guarda tu Pendle (PENDLE)Después de comprar tu Pendle (PENDLE), guárdalo en tu cuenta HTX. Alternativamente, puedes enviarlo a otro lugar mediante transferencia blockchain o utilizarlo para tradear otras criptomonedas.Paso 4: tradear Pendle (PENDLE)Tradear fácilmente con Pendle (PENDLE) en HTX's mercado spot. Simplemente accede a tu cuenta, selecciona tu par de trading, ejecuta tus trades y monitorea en tiempo real. Ofrecemos una experiencia fácil de usar tanto para principiantes como para traders experimentados.

343 Vistas totalesPublicado en 2024.12.12Actualizado en 2026.06.02

Discusiones

Bienvenido a la comunidad de HTX. Aquí puedes mantenerte informado sobre los últimos desarrollos de la plataforma y acceder a análisis profesionales del mercado. A continuación se presentan las opiniones de los usuarios sobre el precio de PENDLE (PENDLE).