Эксперты Beosin изучили атаку на Pendle Penpie

cryptonews.ruPublicado em 2022-06-04Última atualização em 2024-09-04

По данным на 4 сентября 2024 года DeFi-протокол Penpie, построенный на базе Pendle Finance, стал жертвой хакерской атаки, в результате которой было похищено около $27 млн в криптовалюте. Сразу после инцидента команда безопасности Beosin провела собственный анализ произошедшего и выявила ключевые уязвимости, которые позволили злоумышленникам успешно осуществить атаку.

Penpie — это платформа DeFi, интегрированная с Pendle Finance, которая предоставляет пользователям возможность блокировать токены PENDLE для получения прав управления и увеличения доходности в рамках экосистемы. Цель площадки заключается в улучшении доходности для клиентов и предоставлении услуг по усилению veTokenomics.

Атака была проведена с использованием уязвимости функции reentrant в контракте вознаграждений, что позволило злоумышленнику манипулировать балансом стейкингового контракта и получить чрезмерные вознаграждения. Основной этап подготовки атаки включал создание злоумышленником нового рынка и Yield с помощью «фабричного контракта» в протоколе Penpie, где контракт SY был использован в качестве атакующего.

Хакер также воспользовался флэш-займом, чтобы получить необходимую ликвидность для проведения атаки, и инициировал функцию batchHarvestMarketRewards, которая позволила ему управлять балансом рынка и получать неправомерные вознаграждения. В процессе атаки злоумышленник несколько раз повторил эту операцию, увеличивая свою прибыль за счет манипуляций с функцией redeemRewards.

Команда Pendle, узнав о случившемся, незамедлительно приостановила работу контрактов, что позволило предотвратить дальнейшие убытки и сохранить активы на сумму $105 млн. Однако хакеру удалось вывести около $27 млн, из которых 2900 ETH (приблизительно $6,9 млн) уже были переведены в Tornado Cash — сервис, известный своими возможностями по анонимизации транзакций.

В настоящее время Penpie активно пытается связаться с хакером, предлагая ему вознаграждение за возвращение украденных средств. В рамках реагирования на инцидент, команда безопасности Beosin рекомендовала добавить модификаторы для защиты от повторных входов в функции контракта, использовать единый контракт для генерации токенов, а также провести полный аудит безопасности перед запуском проекта.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Criptomoedas em alta

CitreaCTR

wrapped stUSDTWSTUSDT

Velodrome FinanceVELODROME

BrevisBREV

ZRX（0X）ZRX

PancakeSwapCAKE

Leituras Relacionadas

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

"A Short Seller's Dire Prediction: AI Boom Fading, US Stocks to Peak by Q3 with 30-50% Decline" Prominent macro investors Jeffrey Gundlach and Felix Zulauf warn that the AI-driven market rally is nearing its end, forecasting a major US stock market correction of 30-50%, potentially beginning as early as Q3. Their analysis points to alarming parallels with historical market tops, citing extreme concentration in the top AI-related stocks within the S&P 500. Zulauf's bearish thesis hinges on unsustainable capital expenditure trends among major cloud companies, negative free cash flow emergence, and soaring semiconductor prices. Gundlach highlights dangerous parallels to the 1999 tech bubble peak. A key divergence from conventional wisdom is Gundlach's view that long-term Treasury yields will not fall meaningfully even during a recession, due to America's structurally out-of-control fiscal deficits and soaring interest costs. He warns this could force the government into yield curve control or even a sovereign debt restructuring. Both investors express severe concerns about the opaque private credit market, drawing parallels to the pre-2008 financial crisis environment. They allege widespread rating inflation, misrepresented credit quality, liquidity illusions, and fraudulent asset valuations within this sector. The analysis links the AI boom and private credit crisis through financing costs. They argue that as AI companies' cash flows weaken and they seek funding, a high and sticky long-term interest rate environment will severely stress lower-rated corporate borrowers, exposing cracks in credit markets. Finally, they predict a regime shift where the US dollar weakens and US equities underperform global markets, marking the end of their long dominance. The stage is set for a significant market reversal.

marsbitHá 6m

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

marsbitHá 6m

Why Does No One Buy DeFi Insurance?

**Title: Why Isn't DeFi Insurance Being Bought?** DeFi insurance, which promised automated, unbiased payouts via smart contracts, has failed to gain traction. The core issue is economic: high premiums severely erode the yields that attract users to DeFi in the first place. For example, insuring a USDC deposit on Aave V3 could cost 1.5–2.5% of the annual yield, leaving a net return barely above a savings account. For riskier platforms like Maple Finance or Ethena, premiums can even turn net yields negative. Consequently, users often forgo insurance, as it nullifies their profit motive. The market also suffers from structural flaws. First, DeFi risks are highly correlated (e.g., an oracle failure can impact multiple protocols simultaneously), unlike the independent risks in traditional insurance. This makes large-scale events potentially catastrophic for insurers. Second, the total capital in DeFi insurance pools (e.g., Nexus Mutual's ~$81.5M) is minuscule compared to the hundreds of billions in total value locked (TVL), creating a massive capacity gap. A single major hack could drain the entire industry's reserves. Furthermore, the governance model where tokenholders vote on claims creates a conflict of interest, incentivizing them to deny payouts to protect their own funds. As a result, the sector is shrinking. While pioneers like Nexus Mutual are pivoting to preventative measures (bug bounties) and seeking external capital via reinsurance, the fundamental problems remain. DeFi insurance represents a public good—its stability benefits the entire ecosystem—but without a mechanism to share costs, a "tragedy of the commons" ensues where no one is willing to pay, leaving the system vulnerable.

marsbitHá 20m

marsbitHá 20m

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

SpaceX's share price (SPCX) has fallen sharply, briefly dropping below its $150 IPO price in pre-market trading. The decline follows a catastrophic explosion during a Starship static fire test and was exacerbated by the company's announcement of a planned $20 billion bond issuance. This move, coming soon after its IPO raised $85.7 billion, raised concerns about SpaceX's cash burn rate and AI infrastructure spending surpassing expectations. The sell-off is also tied to a broader global pullback in AI-related stocks, with investors questioning the return on massive capital expenditures. Analysts note the initial IPO surge was largely driven by retail investor frenzy, which has now waned as sentiment turns cautious. With only about 5% of shares currently floating, the market is bracing for significant potential selling pressure when employee lock-up periods expire later this year. While some, like Cathie Wood's ARK Invest, remain long-term bullish on SpaceX's core ventures, other research firms argue the current stock price is driven by narrative rather than fundamentals and that future growth is already priced in. The next potential catalyst is the stock's possible inclusion in the Nasdaq 100 index in July.

Odaily星球日报Há 21m

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

Odaily星球日报Há 21m

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

**BitMart Research Weekly: Fed Hawkishness Weighs on Crypto, RWA Sector Shows Strength** In traditional markets, US equities were mixed as weakening macro data signaled slowing growth. The Federal Reserve held rates at 3.75%, with half of its officials projecting at least one rate hike this year, adopting a more hawkish stance. The crypto market faced sustained pressure. BTC fell 3.7%, underperforming ETH, which dropped 1.2%. Overall market sentiment remained in "Extreme Fear." US spot Bitcoin ETFs saw net outflows of approximately $226.8 million for the week, indicating a lack of sustained institutional buying. Despite the bearish backdrop, the Real World Assets (RWA) narrative gained traction. XLM surged 12.2%, driven by Stellar's RWA tokenization roadmap. Stablecoin market capitalization stabilized near $315.3B, showing structural shifts towards compliant and institutional cash management tools like USDG and BUIDL. A notable stress point emerged as Strategy's STRC traded below its $100 face value for a fifth consecutive week, pressuring its dividend model and raising questions about its Bitcoin treasury management strategy.

marsbitHá 25m

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

marsbitHá 25m

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

Bridgewater founder Ray Dalio links declining U.S. credibility and rising Chinese influence to a modern "tribute system" – a hierarchical order based on power differentials, economic interests, and diplomatic pressure rather than direct control. This shift, he argues, makes U.S. commitments appear negotiable, prompting Asian nations to reassess security and economic alignments. A key market vulnerability is the advanced semiconductor supply chain concentrated in East Asia, which produces the majority of the world's most advanced chips. Dalio suggests that even without direct conflict, uncertainties over commitments, shipping, or supply chain reshoring can trigger asset price volatility in tech stocks, Asian markets, and RMB-denominated assets. While not predicting immediate extreme events, he warns that policy swings, miscalculations, and non-military pressure could reshape regional order, with market reactions preceding any outright confrontation.

marsbitHá 26m

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

marsbitHá 26m

Trading

Spot

Futuros

Artigos em Destaque

Como comprar PENDLE

Bem-vindo à HTX.com!Tornámos a compra de Pendle (PENDLE) simples e conveniente.Segue o nosso guia passo a passo para iniciar a tua jornada no mundo das criptos.Passo 1: cria a tua conta HTXUtiliza o teu e-mail ou número de telefone para te inscreveres numa conta gratuita na HTX.Desfruta de um processo de inscrição sem complicações e desbloqueia todas as funcionalidades.Obter a minha contaPasso 2: vai para Comprar Cripto e escolhe o teu método de pagamentoCartão de crédito/débito: usa o teu visa ou mastercard para comprar Pendle (PENDLE) instantaneamente.Saldo: usa os fundos da tua conta HTX para transacionar sem problemas.Terceiros: adicionamos métodos de pagamento populares, como Google Pay e Apple Pay, para aumentar a conveniência.P2P: transaciona diretamente com outros utilizadores na HTX.Mercado de balcão (OTC): oferecemos serviços personalizados e taxas de câmbio competitivas para os traders.Passo 3: armazena teu Pendle (PENDLE)Depois de comprar o teu Pendle (PENDLE), armazena-o na tua conta HTX.Alternativamente, podes enviá-lo para outro lugar através de transferência blockchain ou usá-lo para transacionar outras criptomoedas.Passo 4: transaciona Pendle (PENDLE)Transaciona facilmente Pendle (PENDLE) no mercado à vista da HTX.Acede simplesmente à tua conta, seleciona o teu par de trading, executa as tuas transações e monitoriza em tempo real.Oferecemos uma experiência de fácil utilização tanto para principiantes como para traders experientes.

411 Visualizações TotaisPublicado em {updateTime}Atualizado em 2026.06.02

Discussões

Bem-vindo à Comunidade HTX. Aqui, pode manter-se informado sobre os mais recentes desenvolvimentos da plataforma e obter acesso a análises profissionais de mercado. As opiniões dos utilizadores sobre o preço de PENDLE (PENDLE) são apresentadas abaixo.