DEUS Finance DAO被盗1570万美元攻击事件分析

Certik2022-04-28 tarihinde yayınlandı2022-04-28 tarihinde güncellendi

Özet

DEUS Finance被恶意利用，造成了约1570万美元（折合人民币约1.03亿）的损失。

北京时间2022年4月28日10:40:14 ，CertiK审计团队监测到DEUS Finance的合约被恶意攻击，造成了约1570万美元（折合人民币约1.03亿）的损失。
攻击者恶意操纵DEI的价格，从DeiLenderSolidex合约中通过提供少量的抵押品提取了大量的DEI。
漏洞交易
https://ftmscan.com/tx/0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5
攻击步骤
①攻击者部署攻击合约并向借贷池DeiLenderSolidex合约提供抵押。②随后攻击者利用攻击合约获得了超过143,200,000 USDC用以发起攻击。
③攻击合约将这143,200,000 个借得的USDC在USDC/DEI交易对池0x5821573中换为9,547,716个DEI，此举导致DEI的价格被大幅提高。
④由于DeiLenderSolidex合约是用预言机来确定用户抵押品的价值，而预言机合约使用被恶意操纵的交易对池的价格作为价格来源。因此通过提高的价格和之前提供的抵押，攻击者可从借贷池（DeiLenderSolidex）中总计借贷到17,246,885 DEI，这一数额远大于之前攻击者提供抵押的金额。

⑤攻击者用9,547,716个 DEI交换到的143,184,725 USDC来偿还闪电贷款，最终获取差价离场。

漏洞分析

通过闪电贷，攻击者能够操纵交易对的状态，并进一步操纵DEUS的预言机价格，以此利用不对等的价值借贷DEI。
资产去向
截至撰稿时，黑客已将攻击所得转到以太坊上并换成ETH，随后将5,446个ETH（总价值约1570万美元）存入Tornado Cash。https://debank.com/profile/0x701428525cbac59dae7af833f19d9c3aaa2a37cb/history
写在最后
预言机合约不应该直接使用交易对池中的价格作为价格来源，而安全审计可以有效地避免这一风险。CertiK安全专家建议：如果只有代币合约被审计，这种情况在审计过程中将会指出第三方依赖风险。项目应该避免直接从交易对池中获取价格。建议根据项目的逻辑，使用更值得信任的预言机：1. 使用多个可靠的链上价格预言机来源，例如Chainlink和Band协议。
2. 使用时间加权平均价格（TWAP）。TWAP代表了一个代币在特定时间范围内的平均价格。因此如果攻击者仅操纵一个区块的价格并不会对平均价格产生太大的影响。
3. 如果合约模式允许，将函数调用者限制在一个非合约/EOA地址。
4. 闪电贷款只允许用户在一次交易中进行借贷。如果合约用例允许，可强制关键交易至少跨越两个区块。

İlgili Okumalar

The Demise of the Trillion-HKD ETF Myth: SK Hynix Plummets, Hong Kong Switches from 'Double Leverage' to 'Flexible Leverage', South Korea Restricts Leveraged ETF Investments

South Korea's AI-driven bull market has taken a sharp downturn, severely impacting SK Hynix's stock and prompting regulatory tightening in both Hong Kong and South Korea on single-stock leveraged products. The CSOP SK Hynix Daily Leveraged (2x) ETF, once the world's largest single-stock leveraged ETF with over HKD 130 billion in assets, saw its value plummet by over 80% as SK Hynix shares fell nearly 46% from their June peak, erasing more than HKD 100 billion. In response, Hong Kong's Securities and Futures Commission (SFC) revised its regulatory framework. Starting August 3rd, fixed 2x leverage for single-stock leveraged and inverse products will shift to a dynamic "flexible leverage" mechanism, where daily leverage can vary up to a maximum of 2x. This aims to balance market development with investor protection but has sparked debate about changes to the products' core features and potential reduced appeal for risk-seeking investors. Simultaneously, South Korean authorities announced plans to further restrict single-stock leveraged ETFs following two consecutive days of market circuit breakers. Proposed measures include capping individual investors' allocations to such products at 20% of their total financial investment assets, increasing trading costs, and enhancing suitability requirements. The Finance Minister publicly apologized, acknowledging insufficient initial risk assessment. Analysts note that while the long-term fundamentals for South Korean semiconductor firms like SK Hynix remain solid, short-term market volatility is heightened due to concentrated leveraged bets and shifting global risk sentiment. The regulatory moves in both markets signal a clear shift from encouraging innovation towards prioritizing risk control, reminding investors of the amplified risks inherent in leveraged products.

marsbit5 dk önce

The Demise of the Trillion-HKD ETF Myth: SK Hynix Plummets, Hong Kong Switches from 'Double Leverage' to 'Flexible Leverage', South Korea Restricts Leveraged ETF Investments

marsbit5 dk önce

After the Privatization of the Internet, Silicon Valley Begins Privatizing Human Civilization

"The Privatization of Human Civilization" The article critiques how AI companies like Anthropic are systematically acquiring and digitizing millions of books—sometimes by destroying physical copies—to build proprietary training datasets for models like Claude. While a lawsuit resulted in a settlement, the author argues the deeper issue transcends copyright: it is about the privatization and centralized control of human knowledge and civilization. This process coincides with a powerful Silicon Valley ideology, exemplified by Marc Andreessen's "Techno-Optimist Manifesto" and movements like e/acc (Effective Accelerationism). This worldview frames technological growth and speed as inherently moral, portraying caution, regulation, and public dissent as obstacles to progress. It often envisions intelligence itself, rather than human well-being, as the ultimate goal, potentially sidelining present human concerns. Figures like Peter Thiel and Curtis Yarvin express skepticism towards democratic processes as too slow, suggesting more centralized, founder-led governance is efficient. This logic extends to AI, where a small team within a company defines the model's "constitution"—its rules, values, and definitions of truth and safety—effectively governing how millions understand the world. Thus, the scanned books symbolize a new form of control. Knowledge isn't erased but is ingested into private, opaque systems. The original, decentralized, and contestable nature of books and public knowledge is replaced by a curated, company-controlled output. The public's access to their own cultural heritage becomes mediated by corporate AI, which remembers civilization only in the form its creators dictate. This is not book-burning but a subtler, potentially more complete privatization of human memory and understanding.

marsbit14 dk önce

After the Privatization of the Internet, Silicon Valley Begins Privatizing Human Civilization

marsbit14 dk önce

No Issuance, Only Tolls: Visa's Stablecoin Gambit Is More Ruthless Than Issuers

**Summary:** In its Q3 2026 earnings, Visa announced strong financial results but focused market attention on its strategic moves in the stablecoin space. Visa joined the Open Standard alliance supporting the new stablecoin OpenUSD (OUSD) and launched its Visa Stablecoin Platform (VSP). This platform provides partners with infrastructure for stablecoin settlement, custody, and conversion between fiat and stablecoins. Crucially, Visa emphasized a "multi-currency, multi-chain" strategy, stating its role is not to pick winners among stablecoin issuers. The analysis suggests Visa's approach is less about competing with established issuers like Tether and Circle, and more about positioning itself as the essential infrastructure layer. By building platforms that handle settlement, wallets, and conversions, Visa aims to profit from transaction fees regardless of which stablecoin gains dominance. The article notes skepticism around the OUSD alliance, with some listed members denying formal participation, viewing it more as a statement of intent than a committed bet. Visa's strategy appears to be a low-cost option: gaining influence in the stablecoin narrative while letting others compete at the issuance layer, ultimately banking on controlling the critical payment channels through which any successful stablecoin must flow.

marsbit29 dk önce

No Issuance, Only Tolls: Visa's Stablecoin Gambit Is More Ruthless Than Issuers

marsbit29 dk önce

Net Profit Soars 1299.9%, Samsung's Q2 Reports the Most Profitable Quarter in History

Samsung Electronics posts record-breaking Q2 2026 results, driven primarily by explosive AI-driven demand for its semiconductor business. Revenue surged 130% year-on-year (YoY) to 171.5 trillion won, while operating profit skyrocketed 1,813.8% to 89.49 trillion won. Net profit reached 71.62 trillion won, a 1,299.9% increase YoY. The Device Solutions (DS) division, which includes memory chips, was the core engine, contributing over 99% of total operating profit. Sales for the DS unit hit a record 127.5 trillion won, with memory revenue reaching 120.8 trillion won, fueled by AI server demand for products like HBM. The company has begun mass production of next-generation HBM4. In contrast, the Device eXperience (DX) division, covering mobile phones and consumer electronics, reported an operating loss of 0.8 trillion won due to rising component costs, highlighting a significant performance split within the company. Other segments showed improvement: Samsung Display's profit rose to 0.7 trillion won, and Harman's profit recovered to 0.4 trillion won. Financially, Samsung's position strengthened dramatically, with cash and equivalents reaching 190 trillion won and operating cash flow hitting a record 105.1 trillion won. The company also engaged in significant share buybacks and dividend payments. Looking ahead, Samsung expects sustained strong demand from AI infrastructure, though acknowledges softer demand in some consumer segments.

marsbit40 dk önce

Net Profit Soars 1299.9%, Samsung's Q2 Reports the Most Profitable Quarter in History

marsbit40 dk önce

Japanese game developer launches Bitcoin, altcoin fund with SBI

Japanese game developer Gumi announced it will launch a 3 billion yen (approx. $18.3 million) crypto asset fund on Saturday in partnership with SBI Financial Services. The fund, operated by SBI Crypto Fund, will primarily invest in Bitcoin and major altcoins, employing staking, rebalancing, and hedging strategies. Gumi stated the fund aims to connect Japan's corporate sector with the crypto market and build operational experience ahead of a potential future lifting of Japan's ban on crypto ETFs. This initiative expands Gumi's crypto business, which includes managing its own substantial crypto holdings, notably in XRP. The company's annual report shows its crypto assets nearly doubled to 14.13 billion yen as of April 2026.

cointelegraph45 dk önce

Japanese game developer launches Bitcoin, altcoin fund with SBI

cointelegraph45 dk önce

İşlemler

Spot