SlowMist раскрыла уязвимость в смарт-контракте KiloEx

cryptonews.ruPublicado em 2025-03-15Última atualização em 2025-04-15

Аналитики SlowMist установили, что причиной взлома проекта KiloEx стала критическая ошибка в контракте MinimalForwarder. Отсутствие базовой проверки доступа позволило злоумышленнику манипулировать ценами через цепочку вызовов смарт-контрактов. В частности, execute-функция дала возможность подменить адрес и подпись, пройти проверку и «вызвать нужные методы без ограничений». Это открыло путь к изменению ценового оракула и последующему извлечению прибыли. В результате хакеры похитили около $7 млн

Исследователи SlowMist подробно описали цепочку вызовов, приведших к атаке. Сначала злоумышленник получил возможность вызвать функцию setPrices в контракте KiloPriceFeed, которая используется для обновления данных о ценах. Это стало возможным благодаря некорректной архитектуре вызовов между контрактами Keeper, PositionKeeper и MinimalForwarder. Уязвимость в последнем позволила передавать любые параметры и обойти проверку данных. В результате, злоумышленник сначала занизил цену и открыл длинную позицию, а затем резко поднял курс и закрыл ее с прибылью.

Представители KiloEx подтвердили факт эксплойта и сообщили, что работают над расследованием совместно с BNB Chain, Manta Network и ведущими компаниями по безопасности, включая Seal-911, SlowMist и Sherlock. Команда отметила, что инцидент затронул несколько экосистем, и ведется активная работа по отслеживанию и возврату украденных криптовалют. Также стало известно, что средства злоумышленника начали перемещаться через протоколы zkBridge и Meson.

Случай с KiloEx снова подчеркнул важность базовых проверок доступа в смарт-контрактах. Ошибка в одном компоненте системы привела к полной компрометации логики торговли и серьезным убыткам. Эксперты призывают команды DeFi-проектов уделять больше внимания безопасности на уровне архитектуры, особенно при использовании контрактов для делегированных вызовов.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Leituras Relacionadas

Stellar’s $0.142 test – Why it may be the buying chance traders await

Stellar's XLM extended its decline, dropping 7.85% to $0.1514 despite a 10.55% increase in trading volume. This suggests active selling rather than support for a recovery. Key technical indicators point to persistent bearish control. XLM broke a key horizontal support and remains below a descending trendline, with the MACD in a bearish crossover and Parabolic SAR dots above the price. The RSI is at 34.42, nearing oversold territory, and the DMI shows bearish momentum is intact. The analysis indicates XLM is likely to drift toward the next major demand zone at $0.142 before any potential recovery attempt can gain traction.

ambcryptoHá 27m

Stellar’s $0.142 test – Why it may be the buying chance traders await

ambcryptoHá 27m

Aave Founder Dismisses Reports Of Payward’s ‘70% Discount’ Stake Purchase

Aave founder Stani Kulechov has dismissed reports claiming that Kraken's parent company, Payward, was negotiating to purchase a 15% stake in Aave Group at a steep 70% discount. The reported deal proposed a $71 million investment at a $385 million valuation, which was framed as a significant discount compared to AAVE's fully diluted token valuation. Kulechov rejected this narrative, stating AAVE would not be sold at such a discount, and highlighted Aave's protocol revenue. The article clarifies the distinction between different entities within the Aave ecosystem—Aave Group, Aave Labs, Aave DAO, and AAVE token holders—noting that an equity discussion in a related company does not equate to selling the protocol or transferring DAO control. It underscores the sensitivity of major DeFi protocols to strategic investment rumors and the importance of accurate terminology to avoid misleading readers. While strategic discussions are common in the crypto sector, Kulechov specifically denied the discounted sale framing. The situation highlights that future developments should be monitored via official Aave channels, and market reactions may depend on whether token holders view the denial as value-supportive or focus on potential future distributions. The key takeaway is the founder's rejection of the 70% discount story, while leaving room for strategic partnerships under different terms.

bitcoinistHá 28m

Aave Founder Dismisses Reports Of Payward’s ‘70% Discount’ Stake Purchase

bitcoinistHá 28m

XRP’s Q3 prediction: How RLUSD’s liquidity shock can help price shoot up

XRP's Q3 price prediction hinges on RLUSD's significant liquidity concentration on the XRP Ledger (XRPL). Data shows RLUSD supply on XRPL now exceeds $804 million, overtaking Ethereum's share and comprising over 52% of its total supply. This liquidity shift is driven by RLUSD's regulatory approval in Japan and strong on-chain inflows, contrasting with stablecoin outflows on Ethereum. Technical analysis notes a range-bound XRP/ETH ratio, while institutional capital flows also favor XRP, with spot ETF inflows versus Ethereum outflows. This convergence of factors suggests a potential breakout for XRP, with price targets looking toward the $1.5-$2 range in Q3.

ambcryptoHá 1h

XRP’s Q3 prediction: How RLUSD’s liquidity shock can help price shoot up

ambcryptoHá 1h

Dogecoin looks weak, yet buyers lurk: Decline ahead or surprise rally?

Dogecoin (DOGE) shows a weak market structure, breaking below key support levels and trading 90% below its all-time high. Technical indicators like the rejection below the 200-day MA and negative Chaikin Money Flow point to continued bearish dominance. However, a TD Sequential buy signal and a recent 98.85% surge in net volume suggest some underlying buying interest and a potential pause in the downtrend, contingent on holding above $0.073. Further weakness is evidenced by extremely low ETF inflows, with only two days of net positive inflows totaling $863K over the past month, aligning with the broader market decline. The short-term path remains unclear between further decline and a surprise rally.

ambcryptoHá 2h

Dogecoin looks weak, yet buyers lurk: Decline ahead or surprise rally?

ambcryptoHá 2h

StablecoinX begins Nasdaq trading with $275M ENA treasury after SPAC merger

StablecoinX has commenced trading on the Nasdaq Capital Market under the ticker USDE following its completed SPAC merger with TLGY Acquisition Corp. The company, positioning itself as the first publicly listed stablecoin infrastructure firm focused on the Ethena ecosystem, enters the market with a treasury of approximately 3.03 billion ENA tokens valued at around $275 million, representing about 20% of Ethena's total token supply. Beyond holding these tokens, StablecoinX plans to build operational businesses around three core segments: infrastructure services via a decentralized verifier node, middleware software for stablecoin integration, and institutional distribution services for Ethena's stablecoins. The move highlights the growing convergence of public equity markets and crypto infrastructure, amid a global stablecoin market exceeding $300 billion.

ambcryptoHá 3h

Trading

Spot