Ущерб от взлома фронтенда DEX Aerodrome в сети Base составил $700 000

cryptonews.ruPublicado a 2025-04-23Actualizado a 2025-11-24

Команда децентрализованной биржи (DEX) Aerodrome в L2 Base выпустила отчет по итогам взлома фронтенда 21 ноября.

Атаку удалось полностью нейтрализовать менее чем за четыре часа благодаря поддержке пяти фирм, специализирующихся на безопасности.

Благодаря этому потери ограничились $700 000 — столько успели лишиться девять пользователей, которые подключились и подписали транзакции на скомпрометированных aerodrome.finance и velodrome.finance, пока они были активны.

В течение двух минут после первой известной вредоносной операции основные кошельки вроде Metamask и Coinbase Wallet стали выводить предупреждения.

Корнем стала внутренняя брешь в безопасности NameSilo — регистратора и партнера по DNS основного провайдера 3DNS. Последний был выбран после консультаций с лидерами отрасли.

Источник: Aerodrome.

По теме: эксперты уверены, что хакер Balancer готовил операцию несколько месяцев

Разбор полетов

По итогам анализа инцидента специалисты пришли к выводу, что злоумышленникам удалось обойти контроль мультиподписей.

Хакеры смогли удалить DNSSEC с обоих доменов. Сотрудник NameSilo изменил или способствовал изменению записей aerodrome.finance и velodrome.finance.

После атаки 3DNS и NameSilo проявили сотрудничество и прозрачность, продолжая расследовать основные причины и пересматривать свои методы работы для предотвращения будущих проблем.

Команда приняла решение не возвращать централизованные домены в ту же инфраструктуру. Новые домены запустят на следующей неделе после консультаций со специалистами по безопасности и руководителями некоторых ведущих корпоративных регистраторов.

По мере миграции разработчики призвали использовать децентрализованные домены, которые по-прежнему остаются безопасными и работоспособными.

Aero Foundations и Velo Foundations работают над планом предоставления юзерам грантов, пропорциональных потерям.

По теме: децентрализация, безопасность, контроль — три кита новой финансовой культуры

Lecturas Relacionadas

Uniswap v4 Hook Analysis: Architecture Design, Common Vulnerabilities, and Protection Practices

Uniswap v4's Hook mechanism is a major innovation, enabling custom logic injection into liquidity pool lifecycle events like swaps and liquidity provisioning. This transforms the AMM into programmable infrastructure, shifting the security model from protocol-level to pool-level, as each pool's safety now depends on its bound Hook contract. The core architecture revolves around the singleton PoolManager contract, which manages all pools via a flash accounting system. State changes are tracked in transient storage and must be settled by the end of a transaction. Hook contracts are permanently bound to pools via a PoolKey, with their permissions encoded directly into their address via specific low-order bits. This design introduces unique security considerations and challenges for future upgrades. Key vulnerabilities and best practices identified include: - **Access Control Gaps:** Early versions of the BaseHook abstract contract only protect `unlockCallback()`, leaving other lifecycle functions (`beforeSwap`, `afterSwap`, etc.) exposed unless explicitly secured by developers. - **Unrestricted Pool Binding:** The `initialize()` function does not validate if a Hook "consents" to a new pool. Hooks must implement their own whitelisting in `beforeInitialize` to prevent unauthorized pool creation. - **Async/Custom Curve Hooks:** These high-risk Hooks can completely replace Uniswap's swap logic. Their security depends entirely on their own implementation, as they operate outside the native protocol's pricing safeguards. - **Delta Accounting Risks:** The system ensures final balance (NonzeroDeltaCount == 0) but cannot guarantee the *correctness* of intermediate delta states, which attackers could manipulate. - **Token Confusion:** Protocols must implement semantic validation for tokens in user-created markets, not just interface checks, to prevent cross-market confusion attacks. The article emphasizes that Hook auditing requires a "sub-protocol" approach due to extended interaction chains, highlighting a significant shift in security methodology for the v4 ecosystem.

marsbitHace 7 min(s)

Uniswap v4 Hook Analysis: Architecture Design, Common Vulnerabilities, and Protection Practices

marsbitHace 7 min(s)

Chips, Open-Source Models, and $50 Trillion: Joe Tsai Reassesses Alibaba Once Again

Alibaba Executive Chairman Joe Tsai recently outlined the company's comprehensive AI strategy in a public discussion. He believes AI represents a massive opportunity, estimating its potential economic impact at up to $50 trillion, stemming from the automation of human intelligence and productivity. Tsai detailed Alibaba's four-layer investment approach across the AI stack: starting from the chip level, moving to cloud infrastructure (Alibaba Cloud), then the model layer with its open-source Qwen model, and finally applications within its vast digital ecosystem (e-commerce, logistics, etc.). The company avoids the energy layer due to China's efficient infrastructure. This broad strategy is designed to ensure Alibaba captures value regardless of where it ultimately concentrates in the AI value chain. He dismissed concerns about an AI investment bubble, pointing to the enormous $50 trillion opportunity. While acknowledging U.S. cloud giants' higher capital expenditure, he argued Chinese firms, including Alibaba (funded by its cash-generative e-commerce core), need to invest more in AI infrastructure. A key theme was technological sovereignty. Tsai positioned open-source models like Qwen as a solution for companies, especially in Europe, seeking independence from proprietary U.S. models and greater data privacy control. He contrasted this with the trend of U.S. giants keeping their models closed-source. Tsai highlighted Alibaba's collaborations with European manufacturers like Bosch and Siemens, using AI for design and quality control. He concluded with an optimistic vision of AI agents enhancing productivity, ultimately freeing up human time for leisure, family, and experiences like live entertainment.

marsbitHace 21 min(s)

Chips, Open-Source Models, and $50 Trillion: Joe Tsai Reassesses Alibaba Once Again

marsbitHace 21 min(s)

This Generation of East Asian Commoners Enriched by TSMC and AI-related South Korean Stocks

An AI-driven stock market boom fueled by semiconductor giants like TSMC and Samsung is transforming personal finances and lifestyles across East Asia. Young professionals, such as 24-year-old South Korean programmer Na Se-bin who invested her life savings, are experiencing dramatic gains and losses, reflecting a widespread retail trading frenzy. In Taiwan, telling someone you work at TSMC has become a notable social advantage, while its stock surge has propelled the local market. Similarly, Korean markets, dominated by Samsung and SK Hynix, have seen massive growth, with even schoolteachers reporting quintupled investments. The AI hardware demand from U.S. tech giants is funneling trillions into Asian exports, creating a wealth effect evident in luxury spending and real estate. The phenomenon underscores the region's pivotal role as the "pick-and-shovel" suppliers of the AI revolution, reshaping ordinary lives through market participation and soaring tech sector salaries.

Odaily星球日报Hace 25 min(s)

This Generation of East Asian Commoners Enriched by TSMC and AI-related South Korean Stocks

Odaily星球日报Hace 25 min(s)

This Generation of East Asian Ordinary People Getting Rich Thanks to TSMC and AI-Related Korean Stocks

The article describes how the global AI boom, driven by demand for semiconductors, is creating newfound wealth for ordinary young investors and professionals in East Asia, particularly in South Korea and Taiwan. Fueled by massive capital expenditure from tech giants, the surge in AI-related exports has propelled stock markets in South Korea, Taiwan, and Japan to significant gains. This has led to a widespread retail investing frenzy. In South Korea, individuals like 24-year-old programmer Na Se-bin and 35-year-old teacher Choi Sung-ho are investing heavily and seeing substantial returns, altering their spending habits. In Taiwan, the chipmaker TSMC, a dominant force in advanced manufacturing, is central to the economic euphoria, offering high salaries and social prestige. The company's stock surge has significantly boosted the local market. The phenomenon extends to Japan, where even companies in seemingly unrelated sectors are benefiting from the AI supply chain. The narrative highlights a region capitalizing on its role as the essential hardware provider for the AI "gold rush," with its tech giants acting as the "sellers of shovels." This has translated into rapid wealth accumulation, a booming luxury market, and a pervasive culture of stock trading among everyday people, including younger generations.

marsbitHace 33 min(s)

This Generation of East Asian Ordinary People Getting Rich Thanks to TSMC and AI-Related Korean Stocks

marsbitHace 33 min(s)

Musk Targets AI Infrastructure Again: Tesla Set to Sell 'Compute Building Blocks'

Tesla has filed a trademark for "Megapod," a modular AI data center hardware system, signaling a potential move into AI infrastructure. The system, as described in the filing, would integrate computer servers, AI processing hardware, networking equipment, power distribution, and cooling into a single, plug-and-play unit. This follows Tesla's existing "mega" product line like the Megapack energy storage system. The move comes less than a year after Tesla disbanded its in-house Dojo supercomputer team, shifting away from custom AI chip development. Analysts suggest Megapod is likely not a direct challenge to NVIDIA's dominant GPU-based systems, but rather targets the supporting infrastructure layer—power, cooling, and rapid deployment—where Tesla's energy business has expertise. The company's Megapack batteries are already being purchased by AI firms like xAI to manage the intense power demands of data centers. While still an early-stage trademark with no product details, Megapod hints at Tesla's broader strategy to commercialize modular AI infrastructure. It aligns with trends seen in Elon Musk's other ventures, such as SpaceX's lucrative contracts to lease GPU compute capacity. The potential market addresses critical bottlenecks in AI expansion: electricity, thermal management, and deployment speed.

marsbitHace 38 min(s)

Musk Targets AI Infrastructure Again: Tesla Set to Sell 'Compute Building Blocks'

marsbitHace 38 min(s)

Trading

Spot
Futuros
活动图片