DEUS Finance DAO被盗1570万美元攻击事件分析

CertikPublicado em 2022-04-28Última atualização em 2022-04-28

Resumo

DEUS Finance被恶意利用，造成了约1570万美元（折合人民币约1.03亿）的损失。

​北京时间2022年4月28日10:40:14 ，CertiK审计团队监测到DEUS Finance的合约被恶意攻击，造成了约1570万美元（折合人民币约1.03亿）的损失。
攻击者恶意操纵DEI的价格，从DeiLenderSolidex合约中通过提供少量的抵押品提取了大量的DEI。
漏洞交易
https://ftmscan.com/tx/0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5
攻击步骤
①攻击者部署攻击合约并向借贷池DeiLenderSolidex合约提供抵押。②随后攻击者利用攻击合约获得了超过143,200,000 USDC用以发起攻击。
③攻击合约将这143,200,000 个借得的USDC在USDC/DEI交易对池0x5821573中换为9,547,716个DEI，此举导致DEI的价格被大幅提高。
④由于DeiLenderSolidex合约是用预言机来确定用户抵押品的价值，而预言机合约使用被恶意操纵的交易对池的价格作为价格来源。因此通过提高的价格和之前提供的抵押，攻击者可从借贷池（DeiLenderSolidex）中总计借贷到17,246,885 DEI，这一数额远大于之前攻击者提供抵押的金额。

预言机

预言机

⑤攻击者用9,547,716个 DEI交换到的143,184,725 USDC来偿还闪电贷款，最终获取差价离场。

漏洞分析

预言机

通过闪电贷，攻击者能够操纵交易对的状态，并进一步操纵DEUS的预言机价格，以此利用不对等的价值借贷DEI。
资产去向
截至撰稿时，黑客已将攻击所得转到以太坊上并换成ETH，随后将5,446个ETH（总价值约1570万美元）存入Tornado Cash。https://debank.com/profile/0x701428525cbac59dae7af833f19d9c3aaa2a37cb/history 
写在最后
预言机合约不应该直接使用交易对池中的价格作为价格来源，而安全审计可以有效地避免这一风险。CertiK安全专家建议：如果只有代币合约被审计，这种情况在审计过程中将会指出第三方依赖风险。项目应该避免直接从交易对池中获取价格。建议根据项目的逻辑，使用更值得信任的预言机：1. 使用多个可靠的链上价格预言机来源，例如Chainlink和Band协议。
2. 使用时间加权平均价格（TWAP）。TWAP代表了一个代币在特定时间范围内的平均价格。因此如果攻击者仅操纵一个区块的价格并不会对平均价格产生太大的影响。
3. 如果合约模式允许，将函数调用者限制在一个非合约/EOA地址。  
4. 闪电贷款只允许用户在一次交易中进行借贷。如果合约用例允许，可强制关键交易至少跨越两个区块。 

Leituras Relacionadas

Japanese game developer launches Bitcoin, altcoin fund with SBI

Japanese game developer Gumi announced it will launch a 3 billion yen (approx. $18.3 million) crypto asset fund on Saturday in partnership with SBI Financial Services. The fund, operated by SBI Crypto Fund, will primarily invest in Bitcoin and major altcoins, employing staking, rebalancing, and hedging strategies. Gumi stated the fund aims to connect Japan's corporate sector with the crypto market and build operational experience ahead of a potential future lifting of Japan's ban on crypto ETFs. This initiative expands Gumi's crypto business, which includes managing its own substantial crypto holdings, notably in XRP. The company's annual report shows its crypto assets nearly doubled to 14.13 billion yen as of April 2026.

cointelegraphHá 1m

Japanese game developer launches Bitcoin, altcoin fund with SBI

cointelegraphHá 1m

Wall Street's Review of the Fed Decision: Walsh Welcomes the Market Replacing 'Rate Hikes'?

The Federal Reserve held interest rates steady at its July meeting. In the absence of clear forward guidance, Chair Wash's tacit approval of rising long-term Treasury yields became the focal point. Major institutions like Goldman Sachs, Barclays, and Nomura interpret this as a signal that the Fed is allowing market-driven tightening to substitute for official rate hikes. Despite three dissenting votes favoring a hike, the overall stance was perceived as dovish. Chair Wash downplayed AI-related price pressures, attributed rising real rates to economic strength, and repeatedly suggested that higher market rates could act in place of policy hikes. He emphasized that while the Fed had "done nothing" in the past 42 days, markets had "done a lot." Analysts highlight that Wash welcomed the significant rise in yields, framing it as markets "learning to play the game rather than watch the referee." This shift implies reduced urgency for the Fed to hike as long as long-end rates remain elevated. However, strategies outsourcing tightening to bond markets carry risks, including potential unanchoring of inflation expectations. Nomura warned that persistent dovish signals could undermine the Fed's inflation-fighting credibility, possibly triggering more aggressive responses from hawkish FOMC members later.

marsbitHá 16m

Wall Street's Review of the Fed Decision: Walsh Welcomes the Market Replacing 'Rate Hikes'?

marsbitHá 16m

E Fund "Quits Drinking"

"Yi Fang Da 'Gives Up Alcohol'" - Summary The article analyzes the recent portfolio adjustments of star fund manager Zhang Kun, focusing on his flagship funds, the Yi Fang Da Blue Chip Select and Yi Fang Da Quality Select. The key trend highlighted is a significant and ongoing reduction in exposure to the consumer sector, particularly liquor (baijiu) stocks like Kweichow Moutai and Wuliangye, which were once core holdings. This shift is driven by several factors: a downturn in the consumer sector's business cycle post-pandemic, with slowing earnings growth for major players; a change in consumer behavior towards value over premium brands; and high channel inventory pressures, especially in the liquor industry. These fundamentals have led to a prolonged phase of valuation contraction for consumer stocks. Concurrently, market capital has rotated aggressively towards the high-growth technology sector, especially AI-related chains, which have dominated fund inflows. This style shift has further diminished the attractiveness of traditional consumer "core assets" for many funds. As a result, Zhang Kun's funds have drastically cut their consumer stock allocations. For example, the Blue Chip Select's baijiu holding proportion has fallen from over 40% to around 20%, and its overall top 10 holdings concentration dropped sharply. This mirrors a broader trend in the active equity fund industry, where allocations to consumer staples have plummeted to multi-year lows while technology holdings have surged. The article concludes that while the consumer sector's valuations are now at historical lows, offering some margin of safety, the fundamental outlook remains challenging due to weak macro consumption recovery and intense internal competition. Therefore, the sector is likely to see only sporadic rebounds rather than a sustained recovery, continuing to weigh on the performance of funds still heavily invested in it. Zhang Kun's timely reduction of Korean semiconductor holdings in his Asia Select fund amid a market crash is also noted as a contrast to his domestic strategy.

marsbitHá 26m

E Fund "Quits Drinking"

marsbitHá 26m

Before the Second Attempt at Hong Kong IPO, Topstar 'Hands Out' 548 Million in Related-Party Orders

Tosda, an industrial robotics firm, is making its second attempt at a Hong Kong listing shortly after its first application lapsed. The company has undergone a significant strategic shift, pivoting away from its lower-margin intelligent energy and environmental management system (IEEMS) business to focus on core robotics and machinery. This "revenue-reduction, profit-growth" strategy saw revenue nearly halve from 2022 to 2025, but resulted in a sharp turnaround to profitability, with a 1147% year-on-year increase in Q1 2026 net profit. This restructuring involved spinning off the IEEMS business, leading to a substantial jump in related-party transactions. Following the departure of a former executive, two newly associated companies are expected to handle up to 548 million RMB worth of IEEMS orders in 2026, with Tosda acting as a platform charging a 3% management fee. While profitability has improved, several financial concerns remain. Accounts receivable collection cycles have lengthened, inventory—particularly for robots—has surged significantly despite falling revenue, and the company faces challenges in overseas market expansion. Notably, overseas business currently has a lower gross margin than domestic operations. The company was also recently reprimanded by regulators for accounting inaccuracies related to revenue recognition and bad debt provisions. The success of its strategic pivot and its second listing attempt will depend on managing these financial risks, the transparency of its new business model, and the long-term performance of its core robotics segment.

marsbitHá 36m

Before the Second Attempt at Hong Kong IPO, Topstar 'Hands Out' 548 Million in Related-Party Orders

marsbitHá 36m

Is the AI Bull Market in Jeopardy? Philadelphia Semiconductor Index Breaks Below Key Support at 11,200 Points

The Philadelphia Semiconductor Index (SOX) faces a critical technical and fundamental test. It recently breached a key short-term support level around 11,200 points—a level that held in mid-July—and closed below it. Technical indicators have deteriorated, with the 21-day moving average crossing below the 50-day, signaling bearish momentum. Should the 11,200 support fail, the next major support is the 200-day moving average. The sell-off, which saw memory chip stocks like Micron and Western Digital plunge over 10%, stems from growing concerns about the cyclicality and quality of AI demand. Market participants question the sustainability of the AI capital expenditure boom, highlighted by divergences between the capital expenditures of mega-cap tech firms and semiconductor index performance. However, some positive structural shifts are emerging. Institutional positioning has normalized, unwinding the previously crowded "long semiconductors, short Mag 7" trade, leaving cleaner positioning. Seasonal tailwinds are also approaching, as the NDX historically performs well after this period, potentially supporting a rebound if retail inflows resume. The core question is whether the SOX can hold the 11,200 support. A failure could trigger further declines toward the 200-day moving average, while a successful defense, combined with lighter positioning and seasonal support, could offer a recovery window for the sector.

marsbitHá 36m

Is the AI Bull Market in Jeopardy? Philadelphia Semiconductor Index Breaks Below Key Support at 11,200 Points

marsbitHá 36m

Trading

Spot
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow