DEUS Finance DAO被盗1570万美元攻击事件分析

CertikPubblicato 2022-04-28Pubblicato ultima volta 2022-04-28

Introduzione

DEUS Finance被恶意利用，造成了约1570万美元（折合人民币约1.03亿）的损失。

北京时间2022年4月28日10:40:14 ，CertiK审计团队监测到DEUS Finance的合约被恶意攻击，造成了约1570万美元（折合人民币约1.03亿）的损失。
攻击者恶意操纵DEI的价格，从DeiLenderSolidex合约中通过提供少量的抵押品提取了大量的DEI。
漏洞交易
https://ftmscan.com/tx/0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5
攻击步骤
①攻击者部署攻击合约并向借贷池DeiLenderSolidex合约提供抵押。②随后攻击者利用攻击合约获得了超过143,200,000 USDC用以发起攻击。
③攻击合约将这143,200,000 个借得的USDC在USDC/DEI交易对池0x5821573中换为9,547,716个DEI，此举导致DEI的价格被大幅提高。
④由于DeiLenderSolidex合约是用预言机来确定用户抵押品的价值，而预言机合约使用被恶意操纵的交易对池的价格作为价格来源。因此通过提高的价格和之前提供的抵押，攻击者可从借贷池（DeiLenderSolidex）中总计借贷到17,246,885 DEI，这一数额远大于之前攻击者提供抵押的金额。

⑤攻击者用9,547,716个 DEI交换到的143,184,725 USDC来偿还闪电贷款，最终获取差价离场。

漏洞分析

通过闪电贷，攻击者能够操纵交易对的状态，并进一步操纵DEUS的预言机价格，以此利用不对等的价值借贷DEI。
资产去向
截至撰稿时，黑客已将攻击所得转到以太坊上并换成ETH，随后将5,446个ETH（总价值约1570万美元）存入Tornado Cash。https://debank.com/profile/0x701428525cbac59dae7af833f19d9c3aaa2a37cb/history
写在最后
预言机合约不应该直接使用交易对池中的价格作为价格来源，而安全审计可以有效地避免这一风险。CertiK安全专家建议：如果只有代币合约被审计，这种情况在审计过程中将会指出第三方依赖风险。项目应该避免直接从交易对池中获取价格。建议根据项目的逻辑，使用更值得信任的预言机：1. 使用多个可靠的链上价格预言机来源，例如Chainlink和Band协议。
2. 使用时间加权平均价格（TWAP）。TWAP代表了一个代币在特定时间范围内的平均价格。因此如果攻击者仅操纵一个区块的价格并不会对平均价格产生太大的影响。
3. 如果合约模式允许，将函数调用者限制在一个非合约/EOA地址。
4. 闪电贷款只允许用户在一次交易中进行借贷。如果合约用例允许，可强制关键交易至少跨越两个区块。

Letture associate

13 Business Lines Surpass $100 Million in Annualized Revenue, Robinhood Moves Toward a 'Super Financial App'

Robinhood Q2 2026 Earnings: Record Revenue and a Push Towards a "Super Financial App" Robinhood (HOOD) reported strong Q2 2026 results, with net revenue reaching $1.308 billion, up 32% year-over-year, and net income hitting $561 million, a 45% increase. The company now has 13 distinct business lines each generating over $100 million in annualized revenue. Key drivers included a 44% surge in transaction-based revenue to $776 million, led by a more than 10x growth in "event contracts" (prediction markets) and strong performance in stocks and options. User metrics also grew, with funded accounts rising to 28.4 million and total assets under custody reaching $369 billion. The Robinhood Gold subscription service hit a record 4.8 million users. The report highlights a strategic shift for Robinhood. Moving beyond its core as a zero-commission trading platform for retail investors, it is actively building a broader financial ecosystem. This includes expanding into wealth management (Robinhood Strategies), payments (Robinhood Credit Card), and next-generation infrastructure like AI-powered "Agentic Trading" and its own Ethereum Layer 2 blockchain, Robinhood Chain. The company's goal is to evolve from a trading app into a comprehensive "super financial app," offering a one-stop shop for investing, cash management, and future on-chain finance.

Odaily星球日报26 min fa

13 Business Lines Surpass $100 Million in Annualized Revenue, Robinhood Moves Toward a 'Super Financial App'

Odaily星球日报26 min fa

13 Business Lines Surpass $100 Million in Annualized Revenue, Robinhood Advances Toward a 'Super Financial App'

On July 30th, Robinhood (HOOD) reported its Q2 2026 financial results, showcasing significant growth with record revenue and profits. The company achieved a net revenue of $1.308 billion, a 32% year-over-year (YoY) increase, and a net income of $561 million, up 45% YoY. This strong performance was driven by robust trading activity and expansion into new financial services. A key highlight was the surge in transaction-based revenue, which rose 44% YoY to $776 million. Notably, income from event contracts (prediction markets) skyrocketed over 10x to $156 million, emerging as a major new growth driver alongside strong gains in stock and options trading. However, crypto trading revenue declined by 38%. Beyond trading, Robinhood is successfully diversifying its revenue streams. User assets grew 32% to $369 billion, and the subscription service Robinhood Gold reached a record 4.8 million users. The company revealed that 13 of its business lines now generate over $100 million in annualized revenue, including its new credit card, prediction markets, and Gold subscriptions. Looking forward, Robinhood is strategically investing in AI and blockchain to build a comprehensive financial ecosystem. It has launched AI-powered "Agentic Trading" and the "Robinhood Chain," a layer-2 blockchain network. The company's vision is evolving from a retail trading platform into a "super financial app" that integrates trading, wealth management, payments, and next-generation digital asset services, though regulatory hurdles remain for some new ventures.

marsbit27 min fa

13 Business Lines Surpass $100 Million in Annualized Revenue, Robinhood Advances Toward a 'Super Financial App'

marsbit27 min fa

Ethereum Foundation adds SEAL 911 co-founder to board as privacy focus grows

The Ethereum Foundation (EF) has appointed crypto security expert Pascal "pcaversaccio" Caversaccio, co-founder of SEAL 911, to its board of directors. This voluntary one-year appointment aligns with the EF's heightened organizational focus on privacy and security, which it recently deemed "non-negotiable protocol guarantees." Caversaccio is a long-time contributor, a member of the EF's Silviculture Society advisory group, and the author of key documents on Ethereum's cypherpunk ethos and privacy roadmap. The board, which also includes Aya Miyaguchi, Vitalik Buterin, and Patrick Storchenegger, sets the EF's vision and acts as a "security council" to protect its mission. The move underscores the Foundation's commitment to advancing layer-1 privacy, post-quantum security, and Ethereum's self-sovereignty.

cointelegraph51 min fa

Ethereum Foundation adds SEAL 911 co-founder to board as privacy focus grows

cointelegraph51 min fa

Fed Drops 'Hawkish Bomb' Late at Night: Interest Rates on Hold, Internal Divisions Unseen in a Decade

The Federal Reserve held interest rates steady at 3.50%-3.75% on July 29, marking the fifth consecutive pause since late 2026. While the decision was widely expected, it revealed a significant internal rift. Three FOMC voting members—Hammack, Kashkari, and Logan—dissented, advocating for a 25-basis-point hike. This level of opposition, the first of its kind since 2016, signals persistent hawkish pressure. Chairman Wash, in a post-meeting press conference, delivered a firm message, emphasizing an unwavering commitment to the 2% inflation target and stating the Fed "would not hesitate to act." He announced a substantial shift away from forward guidance, urging markets to interpret economic data independently. Wash also highlighted AI-related capital spending as a key variable, noting its potential dual impact on boosting productivity while potentially pushing up certain prices. Market reaction was pronounced. Stocks fell sharply, with the Dow dropping over 2% for its worst day in 15 months. Long-term Treasury yields surged, with the 30-year yield hitting its highest since 2007, while the dollar weakened and gold briefly rose above $4,100. The combination of internal policy dissent and a shift toward data-dependent communication introduced significant uncertainty into the market outlook.

marsbit54 min fa

Fed Drops 'Hawkish Bomb' Late at Night: Interest Rates on Hold, Internal Divisions Unseen in a Decade

marsbit54 min fa

After R&D Investment Catches Up with the U.S., Is the Sino-U.S. Chip Competition Still Just About Money?

The article examines the significance of recent data showing China's total R&D expenditure, measured by purchasing power parity (PPP), catching up to or slightly surpassing that of the United States in 2024. It argues that while this milestone reflects China's immense capacity to mobilize research resources, the competition in semiconductors now extends far beyond sheer financial input. The analysis highlights key differences: China's R&D is heavily skewed towards experimental development (over 80%), focusing on product engineering and industrialization, whereas the U.S. allocates a proportionally larger share (about 15%) to basic research. Furthermore, leading U.S. semiconductor firms reinvest a significant portion of their substantial global sales revenue into R&D, creating a sustainable commercial innovation cycle that is difficult to replicate. The article emphasizes that semiconductor progress depends on converting R&D into commercially viable products that pass rigorous customer validation and achieve repeat orders, not just on spending levels. It concludes that as China enters the top tier of R&D spenders, the critical challenges shift to improving resource allocation efficiency, fostering long-term basic research, and building effective mechanisms to bridge the gap between laboratory discoveries and reliable, market-ready industrial capabilities.

marsbit1 h fa

After R&D Investment Catches Up with the U.S., Is the Sino-U.S. Chip Competition Still Just About Money?

marsbit1 h fa

Trading

Spot