Эксперты Beosin изучили атаку на Pendle Penpie

cryptonews.ruPubblicato 2022-06-04Pubblicato ultima volta 2024-09-04

По данным на 4 сентября 2024 года DeFi-протокол Penpie, построенный на базе Pendle Finance, стал жертвой хакерской атаки, в результате которой было похищено около $27 млн в криптовалюте. Сразу после инцидента команда безопасности Beosin провела собственный анализ произошедшего и выявила ключевые уязвимости, которые позволили злоумышленникам успешно осуществить атаку.

Penpie — это платформа DeFi, интегрированная с Pendle Finance, которая предоставляет пользователям возможность блокировать токены PENDLE для получения прав управления и увеличения доходности в рамках экосистемы. Цель площадки заключается в улучшении доходности для клиентов и предоставлении услуг по усилению veTokenomics.

Атака была проведена с использованием уязвимости функции reentrant в контракте вознаграждений, что позволило злоумышленнику манипулировать балансом стейкингового контракта и получить чрезмерные вознаграждения. Основной этап подготовки атаки включал создание злоумышленником нового рынка и Yield с помощью «фабричного контракта» в протоколе Penpie, где контракт SY был использован в качестве атакующего.

Хакер также воспользовался флэш-займом, чтобы получить необходимую ликвидность для проведения атаки, и инициировал функцию batchHarvestMarketRewards, которая позволила ему управлять балансом рынка и получать неправомерные вознаграждения. В процессе атаки злоумышленник несколько раз повторил эту операцию, увеличивая свою прибыль за счет манипуляций с функцией redeemRewards.

Команда Pendle, узнав о случившемся, незамедлительно приостановила работу контрактов, что позволило предотвратить дальнейшие убытки и сохранить активы на сумму $105 млн. Однако хакеру удалось вывести около $27 млн, из которых 2900 ETH (приблизительно $6,9 млн) уже были переведены в Tornado Cash — сервис, известный своими возможностями по анонимизации транзакций.

В настоящее время Penpie активно пытается связаться с хакером, предлагая ему вознаграждение за возвращение украденных средств. В рамках реагирования на инцидент, команда безопасности Beosin рекомендовала добавить модификаторы для защиты от повторных входов в функции контракта, использовать единый контракт для генерации токенов, а также провести полный аудит безопасности перед запуском проекта.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Crypto di tendenza

CitreaCTR

wrapped stUSDTWSTUSDT

Velodrome FinanceVELODROME

BrevisBREV

ZRX（0X）ZRX

PancakeSwapCAKE

Letture associate

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

"A Short Seller's Dire Prediction: AI Boom Fading, US Stocks to Peak by Q3 with 30-50% Decline" Prominent macro investors Jeffrey Gundlach and Felix Zulauf warn that the AI-driven market rally is nearing its end, forecasting a major US stock market correction of 30-50%, potentially beginning as early as Q3. Their analysis points to alarming parallels with historical market tops, citing extreme concentration in the top AI-related stocks within the S&P 500. Zulauf's bearish thesis hinges on unsustainable capital expenditure trends among major cloud companies, negative free cash flow emergence, and soaring semiconductor prices. Gundlach highlights dangerous parallels to the 1999 tech bubble peak. A key divergence from conventional wisdom is Gundlach's view that long-term Treasury yields will not fall meaningfully even during a recession, due to America's structurally out-of-control fiscal deficits and soaring interest costs. He warns this could force the government into yield curve control or even a sovereign debt restructuring. Both investors express severe concerns about the opaque private credit market, drawing parallels to the pre-2008 financial crisis environment. They allege widespread rating inflation, misrepresented credit quality, liquidity illusions, and fraudulent asset valuations within this sector. The analysis links the AI boom and private credit crisis through financing costs. They argue that as AI companies' cash flows weaken and they seek funding, a high and sticky long-term interest rate environment will severely stress lower-rated corporate borrowers, exposing cracks in credit markets. Finally, they predict a regime shift where the US dollar weakens and US equities underperform global markets, marking the end of their long dominance. The stage is set for a significant market reversal.

marsbit5 min fa

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

marsbit5 min fa

Why Does No One Buy DeFi Insurance?

**Title: Why Isn't DeFi Insurance Being Bought?** DeFi insurance, which promised automated, unbiased payouts via smart contracts, has failed to gain traction. The core issue is economic: high premiums severely erode the yields that attract users to DeFi in the first place. For example, insuring a USDC deposit on Aave V3 could cost 1.5–2.5% of the annual yield, leaving a net return barely above a savings account. For riskier platforms like Maple Finance or Ethena, premiums can even turn net yields negative. Consequently, users often forgo insurance, as it nullifies their profit motive. The market also suffers from structural flaws. First, DeFi risks are highly correlated (e.g., an oracle failure can impact multiple protocols simultaneously), unlike the independent risks in traditional insurance. This makes large-scale events potentially catastrophic for insurers. Second, the total capital in DeFi insurance pools (e.g., Nexus Mutual's ~$81.5M) is minuscule compared to the hundreds of billions in total value locked (TVL), creating a massive capacity gap. A single major hack could drain the entire industry's reserves. Furthermore, the governance model where tokenholders vote on claims creates a conflict of interest, incentivizing them to deny payouts to protect their own funds. As a result, the sector is shrinking. While pioneers like Nexus Mutual are pivoting to preventative measures (bug bounties) and seeking external capital via reinsurance, the fundamental problems remain. DeFi insurance represents a public good—its stability benefits the entire ecosystem—but without a mechanism to share costs, a "tragedy of the commons" ensues where no one is willing to pay, leaving the system vulnerable.

marsbit19 min fa

marsbit19 min fa

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

SpaceX's share price (SPCX) has fallen sharply, briefly dropping below its $150 IPO price in pre-market trading. The decline follows a catastrophic explosion during a Starship static fire test and was exacerbated by the company's announcement of a planned $20 billion bond issuance. This move, coming soon after its IPO raised $85.7 billion, raised concerns about SpaceX's cash burn rate and AI infrastructure spending surpassing expectations. The sell-off is also tied to a broader global pullback in AI-related stocks, with investors questioning the return on massive capital expenditures. Analysts note the initial IPO surge was largely driven by retail investor frenzy, which has now waned as sentiment turns cautious. With only about 5% of shares currently floating, the market is bracing for significant potential selling pressure when employee lock-up periods expire later this year. While some, like Cathie Wood's ARK Invest, remain long-term bullish on SpaceX's core ventures, other research firms argue the current stock price is driven by narrative rather than fundamentals and that future growth is already priced in. The next potential catalyst is the stock's possible inclusion in the Nasdaq 100 index in July.

Odaily星球日报20 min fa

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

Odaily星球日报20 min fa

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

**BitMart Research Weekly: Fed Hawkishness Weighs on Crypto, RWA Sector Shows Strength** In traditional markets, US equities were mixed as weakening macro data signaled slowing growth. The Federal Reserve held rates at 3.75%, with half of its officials projecting at least one rate hike this year, adopting a more hawkish stance. The crypto market faced sustained pressure. BTC fell 3.7%, underperforming ETH, which dropped 1.2%. Overall market sentiment remained in "Extreme Fear." US spot Bitcoin ETFs saw net outflows of approximately $226.8 million for the week, indicating a lack of sustained institutional buying. Despite the bearish backdrop, the Real World Assets (RWA) narrative gained traction. XLM surged 12.2%, driven by Stellar's RWA tokenization roadmap. Stablecoin market capitalization stabilized near $315.3B, showing structural shifts towards compliant and institutional cash management tools like USDG and BUIDL. A notable stress point emerged as Strategy's STRC traded below its $100 face value for a fifth consecutive week, pressuring its dividend model and raising questions about its Bitcoin treasury management strategy.

marsbit24 min fa

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

marsbit24 min fa

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

Bridgewater founder Ray Dalio links declining U.S. credibility and rising Chinese influence to a modern "tribute system" – a hierarchical order based on power differentials, economic interests, and diplomatic pressure rather than direct control. This shift, he argues, makes U.S. commitments appear negotiable, prompting Asian nations to reassess security and economic alignments. A key market vulnerability is the advanced semiconductor supply chain concentrated in East Asia, which produces the majority of the world's most advanced chips. Dalio suggests that even without direct conflict, uncertainties over commitments, shipping, or supply chain reshoring can trigger asset price volatility in tech stocks, Asian markets, and RMB-denominated assets. While not predicting immediate extreme events, he warns that policy swings, miscalculations, and non-military pressure could reshape regional order, with market reactions preceding any outright confrontation.

marsbit26 min fa

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

marsbit26 min fa

Trading

Spot

Futures

Articoli Popolari

Come comprare PENDLE

Benvenuto in HTX.com! Abbiamo reso l'acquisto di Pendle (PENDLE) semplice e conveniente. Segui la nostra guida passo passo per intraprendere il tuo viaggio nel mondo delle criptovalute.Step 1: Crea il tuo Account HTXUsa la tua email o numero di telefono per registrarti il tuo account gratuito su HTX. Vivi un'esperienza facile e sblocca tutte le funzionalità,Crea il mio accountStep 2: Vai in Acquista crypto e seleziona il tuo metodo di pagamentoCarta di credito/debito: utilizza la tua Visa o Mastercard per acquistare immediatamente PendlePENDLE.Bilancio: Usa i fondi dal bilancio del tuo account HTX per fare trading senza problemi.Terze parti: abbiamo aggiunto metodi di pagamento molto utilizzati come Google Pay e Apple Pay per maggiore comodità.P2P: Fai trading direttamente con altri utenti HTX.Over-the-Counter (OTC): Offriamo servizi su misura e tassi di cambio competitivi per i trader.Step 3: Conserva Pendle (PENDLE)Dopo aver acquistato Pendle (PENDLE), conserva nel tuo account HTX. In alternativa, puoi inviare tramite trasferimento blockchain o scambiare per altre criptovalute.Step 4: Scambia Pendle (PENDLE)Scambia facilmente Pendle (PENDLE) nel mercato spot di HTX. Accedi al tuo account, seleziona la tua coppia di trading, esegui le tue operazioni e monitora in tempo reale. Offriamo un'esperienza user-friendly sia per chi ha appena iniziato che per i trader più esperti.

399 Totale visualizzazioniPubblicato il 2024.12.12Aggiornato il 2026.06.02

Discussioni

Benvenuto nella Community HTX. Qui puoi rimanere informato sugli ultimi sviluppi della piattaforma e accedere ad approfondimenti esperti sul mercato. Le opinioni degli utenti sul prezzo di PENDLE PENDLE sono presentate come di seguito.