Curve DAO Tokens Suffer Millions In Hack Ahead Of White Hat Rescue Bid

BitcoinistPublicado em 2023-08-01Última atualização em 2023-08-01

Resumo

Curve DAO faced a significant setback as millions of CRV tokens were pilfered just moments before a white hat rescue...

Curve DAO faced a significant setback as millions of CRV tokens were pilfered just moments before a white hat rescue operation aimed at securing the funds, as revealed by blockchain data and Curve contributor Banteg.
According to a report, approximately 7 million CRV tokens and $14 million worth of wrapped ether (WETH) were lost during the exploit. The breach occurred within the CRV/ETH pool on Curve Finance, a prominent decentralized exchange (DEX) renowned for its streamlined stablecoin trading capabilities.
The platform features a diverse array of pools that facilitate trading between various tokens, primarily focusing on stablecoins while accommodating other digital assets.
Curve DAO Faces Vulnerability Impacting Multiple Pools
Curve DAO has been struck by a critical vulnerability that has repercussions across various pools, stemming from a bug found in earlier versions of the Vyper programming language.
“crv/eth pool drained minutes before a white hack operation,” Banteg wrote on Twitter, shedding light on the unfortunate incident.
crv/eth pool drained minutes before a whitehack operation :(https://t.co/rhALBzkTEi
— banteg (@bantg) July 30, 2023
The Curve DAO situation has drawn security analysts’ attention, with BlockSec revealing that the renowned cryptocurrency exchange, Binance, funded the wallet employed in the attack. This revelation has raised concerns about the potential risks lurking in the DeFi ecosystem.
Vyper, in response to the issue, has identified the specific versions prone to the malfunctioning reentrancy locks—0.2.15, 0.2.16, and 0.3.0. Projects relying on these vulnerable versions have been urged to contact Vyper for further assistance urgently.
PSA: Vyper versions 0.2.15, 0.2.16 and 0.3.0 are vulnerable to malfunctioning reentrancy locks. The investigation is ongoing but any project relying on these versions should immediately reach out to us.
— Vyper (@vyperlang) July 30, 2023

Curve DAO Breach: Unveiling The Flaw
As security firm Ancilia probes deeper into the situation, the full scope of the vulnerability comes to light. According to their analysis, many contracts were exposed to potential risks.
Specifically, 136 contracts relied on Vyper 0.2.15 with reentrant protection, 98 contracts were built using Vyper 0.2.16, and 226 contracts employed Vyper 0.3.0.
We did a fast run on github.
136 contracts found compiled with vyper 0.2.15 and used reentrant protection;
98 contracts found with 0.2.16 version
226 contracts found with 0.3.0 version
— Ancilia, Inc. (@AnciliaInc) July 30, 2023

As the investigation progresses, the root cause of the vulnerability has been unveiled, shedding light on the extent of the risk. Specific versions of the Vyper compiler were found to need proper implementation of the reentrancy guard.

Market cap of cryptocurrencies reached $1.148 trillion on the daily chart today: TradingView.com
This critical oversight allows for the simultaneous execution of multiple functions, bypassing the intended locking mechanism in affected contracts. As a result, malicious actors could unleash reentrancy attacks capable of draining all funds from vulnerable contracts.

Source: Coingecko
Meanwhile, Curve DAO (CRV) price is in red in all timeframes, losing nearly 13% in the last 24 hours. In the last week, the token has shed 14% of its value, figures from crypto market tracker Coingecko shows.

Leituras Relacionadas

Inflation Has Not Improved. Will Warsh Support a Rate Hike on Friday?

U.S. inflation remained stubbornly high in July, with the PCE price index holding at a year-on-year increase of 3.7%, unchanged from June and still far above the Federal Reserve's 2% target. The core PCE index also stayed flat at 3.3%. While inflation did not worsen, the fact that it did not improve either has increased market expectations for further interest rate hikes. Futures pricing now indicates a higher probability of a rate increase in September and fully prices in one hike by year-end. The economic backdrop is mixed. Second-quarter GDP growth was revised to 1.5%, but underlying components like consumer spending and business investment were robust. However, inflation-adjusted consumer spending stalled in July, and real incomes have barely grown over the past year, eroding purchasing power. The data provides arguments for both sides of the policy debate. The "wait-and-see" camp points to the lack of acceleration in inflation and upcoming methodological changes that may lower reported figures. The "pro-hike" camp highlights that inflation remains hotter than forecasts, sticky services prices, rising diesel and chip costs, and renewed trade tensions with Canada. All eyes are now on Fed Chair Kevin Warsh's upcoming speech at Jackson Hole for clarity on his policy stance. With inflation persistently above target for over five years and midterm elections approaching where prices are a key issue, the pressure for decisive action is mounting. The speech carries significant two-way risk for markets.

marsbitHá 3m

Inflation Has Not Improved. Will Warsh Support a Rate Hike on Friday?

marsbitHá 3m

Goldman Sachs Research Report Analysis: Nvidia's Earnings Exceed Expectations, Target Price of $285 Still Indicates 34% Upside Potential

Goldman Sachs maintains a buy rating on Nvidia with a $285 price target, implying a 34% upside, following its Q2 results. Revenue of $96.2B and data center revenue of $89.0B exceeded expectations. Q3 revenue guidance midpoint of $108.0B was above consensus, though slightly below Goldman's forecast. Notably, Q3 gross margin guidance of 74% was below expectations, potentially due to initial cost pressures from the new Blackwell architecture ramp-up. Key investor focus shifts to the upcoming earnings call for details on: the potential upward revision to Nvidia's $1 trillion cumulative data center revenue target; the structure of its $500 billion partner financing platform; and the gross margin trajectory for late 2026 and 2027. While the results confirm a robust AI spending environment—a positive signal for the broader semiconductor sector including Broadcom, AMD, Marvell, Arm, and Intel—Goldman notes that optimistic expectations are largely priced in. With hyper-scalers having already raised capital expenditure forecasts, the stock may trade in a range post-earnings, requiring new catalysts for a significant re-rating.

marsbitHá 4m

Goldman Sachs Research Report Analysis: Nvidia's Earnings Exceed Expectations, Target Price of $285 Still Indicates 34% Upside Potential

marsbitHá 4m

While Others Go All-In on AI, RockawayX Doubles Down on Crypto

Cryptocurrency investment firm RockawayX, which manages around $20 billion in assets, is raising $150 million for a new liquidity opportunity fund after acquiring crypto hedge fund Relayer Capital. This move bucks the trend of crypto VCs pivoting to AI and robotics. Relayer, founded by former CoinFund partner Austin Barack, will manage the new fund, focusing on undervalued tokens and crypto-related stocks. The acquisition was likely motivated by Relayer's strong performance, with a roughly 70% return this year driven by positions in assets like Hyperliquid and Venice AI, which surged 219% and 1006%, respectively. This expansion is part of RockawayX's broader shift beyond traditional venture capital, having previously entered the crypto treasury management business. The firm is also currently engaged in separate lawsuits with Solana treasury company Solmate following a failed merger attempt.

marsbitHá 14m

While Others Go All-In on AI, RockawayX Doubles Down on Crypto

marsbitHá 14m

SHRINCS BIP published: Quantum-secure Bitcoin comes with a catch

Blockstream has published a Bitcoin Improvement Proposal (BIP) for SHRINCS, its experimental post-quantum signature scheme. Developed to secure Bitcoin against future quantum computing attacks, SHRINCS is a hash-based, stateful signature design that is significantly smaller than current NIST-approved post-quantum alternatives, allowing Bitcoin to maintain a transaction throughput similar to today's ~3 TPS. While it has been tested on Blockstream's Liquid sidechain, the proposal is not yet cryptographically mature and introduces complexity, such as requiring devices to track used keys. Blockstream is also researching lattice-based schemes and zero-knowledge proof aggregation as other potential paths for a quantum-secure Bitcoin, highlighting that governance and consensus present the major challenges for any upgrade.

cointelegraphHá 43m

SHRINCS BIP published: Quantum-secure Bitcoin comes with a catch

cointelegraphHá 43m

US Stock Market Trends (Aug 27): PCE Exceeds Expectations, Pressures Broader Market; Nvidia Rises 4% After-Hours, Nasdaq Futures Up 1%

U.S. Market Trends (Aug 27): PCE Data Weighs on Indices, Nvidia Rises 4% After-Hours, Nasdaq Futures Up 1% U.S. stocks closed slightly lower on Wednesday amid narrow trading. The S&P 500, Nasdaq, and Dow Jones all edged down, ending the Dow's two-day winning streak. The key pressure came from July's PCE inflation data, which showed a 3.7% year-over-year increase, exceeding expectations. While the core PCE met forecasts at 3.3%, the hot headline number boosted Treasury yields and the dollar, dampening hopes for imminent Fed rate cuts. Gold fell below $4,600/oz. Oil prices continued to weaken despite mixed geopolitical signals. The market's real focus was after the close. Nvidia reported Q2 revenue of $96.2 billion, beating estimates, guided for current-quarter revenue to surpass $100 billion for the first time, and projected 70% revenue growth for the next fiscal year. Its shares rose approximately 4% after-hours, lifting Nasdaq futures by about 1%. Amazon's announcement to deploy an additional 2 million GPUs further validated the data center demand narrative for Nvidia. In other sectors, chip stocks like Western Digital and Arm gained. Among the "Magnificent Seven," moves were mixed. Salesforce surged on strong guidance and an expanded partnership with Anthropic. Meta settled a youth addiction case with 29 U.S. states for up to $18 billion, a figure seen as favorable compared to earlier fears. Bitcoin retreated from recent highs, while industrial metals like copper extended their rally. The core market tension remains between inflation concerns pressuring the broader market and strong AI earnings providing sector-specific momentum, setting the tone for early September trading.

marsbitHá 58m

US Stock Market Trends (Aug 27): PCE Exceeds Expectations, Pressures Broader Market; Nvidia Rises 4% After-Hours, Nasdaq Futures Up 1%