Эксперты Beosin изучили атаку на Pendle Penpie

cryptonews.ru2022-06-04 tarihinde yayınlandı2024-09-04 tarihinde güncellendi

По данным на 4 сентября 2024 года DeFi-протокол Penpie, построенный на базе Pendle Finance, стал жертвой хакерской атаки, в результате которой было похищено около $27 млн в криптовалюте. Сразу после инцидента команда безопасности Beosin провела собственный анализ произошедшего и выявила ключевые уязвимости, которые позволили злоумышленникам успешно осуществить атаку.

Penpie — это платформа DeFi, интегрированная с Pendle Finance, которая предоставляет пользователям возможность блокировать токены PENDLE для получения прав управления и увеличения доходности в рамках экосистемы. Цель площадки заключается в улучшении доходности для клиентов и предоставлении услуг по усилению veTokenomics.

Атака была проведена с использованием уязвимости функции reentrant в контракте вознаграждений, что позволило злоумышленнику манипулировать балансом стейкингового контракта и получить чрезмерные вознаграждения. Основной этап подготовки атаки включал создание злоумышленником нового рынка и Yield с помощью «фабричного контракта» в протоколе Penpie, где контракт SY был использован в качестве атакующего.

Хакер также воспользовался флэш-займом, чтобы получить необходимую ликвидность для проведения атаки, и инициировал функцию batchHarvestMarketRewards, которая позволила ему управлять балансом рынка и получать неправомерные вознаграждения. В процессе атаки злоумышленник несколько раз повторил эту операцию, увеличивая свою прибыль за счет манипуляций с функцией redeemRewards.

Команда Pendle, узнав о случившемся, незамедлительно приостановила работу контрактов, что позволило предотвратить дальнейшие убытки и сохранить активы на сумму $105 млн. Однако хакеру удалось вывести около $27 млн, из которых 2900 ETH (приблизительно $6,9 млн) уже были переведены в Tornado Cash — сервис, известный своими возможностями по анонимизации транзакций.

В настоящее время Penpie активно пытается связаться с хакером, предлагая ему вознаграждение за возвращение украденных средств. В рамках реагирования на инцидент, команда безопасности Beosin рекомендовала добавить модификаторы для защиты от повторных входов в функции контракта, использовать единый контракт для генерации токенов, а также провести полный аудит безопасности перед запуском проекта.

Ошибка в тексте? Выделите её мышкой и нажмите Ctrl + Enter

Trend Kriptolar

CitreaCTR

wrapped stUSDTWSTUSDT

Velodrome FinanceVELODROME

BrevisBREV

ZRX（0X）ZRX

PancakeSwapCAKE

İlgili Okumalar

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

"A Short Seller's Dire Prediction: AI Boom Fading, US Stocks to Peak by Q3 with 30-50% Decline" Prominent macro investors Jeffrey Gundlach and Felix Zulauf warn that the AI-driven market rally is nearing its end, forecasting a major US stock market correction of 30-50%, potentially beginning as early as Q3. Their analysis points to alarming parallels with historical market tops, citing extreme concentration in the top AI-related stocks within the S&P 500. Zulauf's bearish thesis hinges on unsustainable capital expenditure trends among major cloud companies, negative free cash flow emergence, and soaring semiconductor prices. Gundlach highlights dangerous parallels to the 1999 tech bubble peak. A key divergence from conventional wisdom is Gundlach's view that long-term Treasury yields will not fall meaningfully even during a recession, due to America's structurally out-of-control fiscal deficits and soaring interest costs. He warns this could force the government into yield curve control or even a sovereign debt restructuring. Both investors express severe concerns about the opaque private credit market, drawing parallels to the pre-2008 financial crisis environment. They allege widespread rating inflation, misrepresented credit quality, liquidity illusions, and fraudulent asset valuations within this sector. The analysis links the AI boom and private credit crisis through financing costs. They argue that as AI companies' cash flows weaken and they seek funding, a high and sticky long-term interest rate environment will severely stress lower-rated corporate borrowers, exposing cracks in credit markets. Finally, they predict a regime shift where the US dollar weakens and US equities underperform global markets, marking the end of their long dominance. The stage is set for a significant market reversal.

marsbit5 dk önce

'Bear' Doomsday Prophecy: AI 'Reaching Its Peak', U.S. Stocks to Top Out Fastest in Q3, Down 30-50%

marsbit5 dk önce

Why Does No One Buy DeFi Insurance?

**Title: Why Isn't DeFi Insurance Being Bought?** DeFi insurance, which promised automated, unbiased payouts via smart contracts, has failed to gain traction. The core issue is economic: high premiums severely erode the yields that attract users to DeFi in the first place. For example, insuring a USDC deposit on Aave V3 could cost 1.5–2.5% of the annual yield, leaving a net return barely above a savings account. For riskier platforms like Maple Finance or Ethena, premiums can even turn net yields negative. Consequently, users often forgo insurance, as it nullifies their profit motive. The market also suffers from structural flaws. First, DeFi risks are highly correlated (e.g., an oracle failure can impact multiple protocols simultaneously), unlike the independent risks in traditional insurance. This makes large-scale events potentially catastrophic for insurers. Second, the total capital in DeFi insurance pools (e.g., Nexus Mutual's ~$81.5M) is minuscule compared to the hundreds of billions in total value locked (TVL), creating a massive capacity gap. A single major hack could drain the entire industry's reserves. Furthermore, the governance model where tokenholders vote on claims creates a conflict of interest, incentivizing them to deny payouts to protect their own funds. As a result, the sector is shrinking. While pioneers like Nexus Mutual are pivoting to preventative measures (bug bounties) and seeking external capital via reinsurance, the fundamental problems remain. DeFi insurance represents a public good—its stability benefits the entire ecosystem—but without a mechanism to share costs, a "tragedy of the commons" ensues where no one is willing to pay, leaving the system vulnerable.

marsbit19 dk önce

marsbit19 dk önce

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

SpaceX's share price (SPCX) has fallen sharply, briefly dropping below its $150 IPO price in pre-market trading. The decline follows a catastrophic explosion during a Starship static fire test and was exacerbated by the company's announcement of a planned $20 billion bond issuance. This move, coming soon after its IPO raised $85.7 billion, raised concerns about SpaceX's cash burn rate and AI infrastructure spending surpassing expectations. The sell-off is also tied to a broader global pullback in AI-related stocks, with investors questioning the return on massive capital expenditures. Analysts note the initial IPO surge was largely driven by retail investor frenzy, which has now waned as sentiment turns cautious. With only about 5% of shares currently floating, the market is bracing for significant potential selling pressure when employee lock-up periods expire later this year. While some, like Cathie Wood's ARK Invest, remain long-term bullish on SpaceX's core ventures, other research firms argue the current stock price is driven by narrative rather than fundamentals and that future growth is already priced in. The next potential catalyst is the stock's possible inclusion in the Nasdaq 100 index in July.

Odaily星球日报20 dk önce

SPCX Pre-Market Dips Below $150 IPO Price, But Don't Rush to Buy Yet

Odaily星球日报20 dk önce

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

**BitMart Research Weekly: Fed Hawkishness Weighs on Crypto, RWA Sector Shows Strength** In traditional markets, US equities were mixed as weakening macro data signaled slowing growth. The Federal Reserve held rates at 3.75%, with half of its officials projecting at least one rate hike this year, adopting a more hawkish stance. The crypto market faced sustained pressure. BTC fell 3.7%, underperforming ETH, which dropped 1.2%. Overall market sentiment remained in "Extreme Fear." US spot Bitcoin ETFs saw net outflows of approximately $226.8 million for the week, indicating a lack of sustained institutional buying. Despite the bearish backdrop, the Real World Assets (RWA) narrative gained traction. XLM surged 12.2%, driven by Stellar's RWA tokenization roadmap. Stablecoin market capitalization stabilized near $315.3B, showing structural shifts towards compliant and institutional cash management tools like USDG and BUIDL. A notable stress point emerged as Strategy's STRC traded below its $100 face value for a fifth consecutive week, pressuring its dividend model and raising questions about its Bitcoin treasury management strategy.

marsbit24 dk önce

BitMart Research Institute Weekly Insights: Fed Hawkish Expectations Heat Up, Crypto Market Continues to Face Pressure, RWA Sector Defies Trend and Breaks Out

marsbit24 dk önce

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

Bridgewater founder Ray Dalio links declining U.S. credibility and rising Chinese influence to a modern "tribute system" – a hierarchical order based on power differentials, economic interests, and diplomatic pressure rather than direct control. This shift, he argues, makes U.S. commitments appear negotiable, prompting Asian nations to reassess security and economic alignments. A key market vulnerability is the advanced semiconductor supply chain concentrated in East Asia, which produces the majority of the world's most advanced chips. Dalio suggests that even without direct conflict, uncertainties over commitments, shipping, or supply chain reshoring can trigger asset price volatility in tech stocks, Asian markets, and RMB-denominated assets. While not predicting immediate extreme events, he warns that policy swings, miscalculations, and non-military pressure could reshape regional order, with market reactions preceding any outright confrontation.

marsbit26 dk önce

Can the US Maintain Its Credibility? Ray Dalio's Vision of a 'Tribute-Style' New Order

marsbit26 dk önce

İşlemler

Spot

Futures

Popüler Makaleler

PENDLE Nasıl Satın Alınır

HTX.com’a hoş geldiniz! Pendle (PENDLE) satın alma işlemlerini basit ve kullanışlı bir hâle getirdik. Adım adım açıkladığımız rehberimizi takip ederek kripto yolculuğunuza başlayın. 1. Adım: HTX Hesabınızı OluşturunHTX'te ücretsiz bir hesap açmak için e-posta adresinizi veya telefon numaranızı kullanın. Sorunsuzca kaydolun ve tüm özelliklerin kilidini açın. Hesabımı Aç2. Adım: Kripto Satın Al Bölümüne Gidin ve Ödeme Yönteminizi SeçinKredi/Banka Kartı: Visa veya Mastercard'ınızı kullanarak anında Pendle (PENDLE) satın alın.Bakiye: Sorunsuz bir şekilde işlem yapmak için HTX hesap bakiyenizdeki fonları kullanın.Üçüncü Taraflar: Kullanımı kolaylaştırmak için Google Pay ve Apple Pay gibi popüler ödeme yöntemlerini ekledik.P2P: HTX'teki diğer kullanıcılarla doğrudan işlem yapın.Borsa Dışı (OTC): Yatırımcılar için kişiye özel hizmetler ve rekabetçi döviz kurları sunuyoruz.3. Adım: Pendle (PENDLE) Varlıklarınızı SaklayınPendle (PENDLE) satın aldıktan sonra HTX hesabınızda saklayın. Alternatif olarak, blok zinciri transferi yoluyla başka bir yere gönderebilir veya diğer kripto para birimlerini takas etmek için kullanabilirsiniz.4. Adım: Pendle (PENDLE) Varlıklarınızla İşlem YapınHTX'in spot piyasasında Pendle (PENDLE) ile kolayca işlemler yapın.Hesabınıza erişin, işlem çiftinizi seçin, işlemlerinizi gerçekleştirin ve gerçek zamanlı olarak izleyin. Hem yeni başlayanlar hem de deneyimli yatırımcılar için kullanıcı dostu bir deneyim sunuyoruz.

377 Toplam GörüntülenmeYayınlanma 2024.12.12Güncellenme 2026.06.02

Tartışmalar

HTX Topluluğuna hoş geldiniz. Burada, en son platform gelişmeleri hakkında bilgi sahibi olabilir ve profesyonel piyasa görüşlerine erişebilirsiniz. Kullanıcıların PENDLE (PENDLE) fiyatı hakkındaki görüşleri aşağıda sunulmaktadır.