Inverse Finance被盗1450万美元事件分析

CertikОпубліковано о 2022-04-03Востаннє оновлено о 2022-04-03

Анотація

该事件发生的根本原因在于外部价格预言机依赖导致价格被操纵，因此攻击者可通过操纵价格来借用资产。

北京时间2022年4月2日19时，CertiK安全技术团队监测到Inverse Finance被恶意利用，导致价值约1450万美元的资产受到损失。
该事件发生的根本原因在于外部价格预言机依赖导致价格被操纵，因此攻击者可通过操纵价格来借用资产。
攻击流程
在发起攻击之前，攻击者做了如下准备:
1. 首先，攻击者部署了一个恶意合约。该合约地址为：0xea0c959bbb7476ddd6cd4204bdee82b790aa1562
2. 其次，攻击者在SushiSwap/Curve.fi中进行调换，以操纵交易中的价格，该交易地址为：0x20a6dcff06a791a7f8be9f423053ce8caee3f9eecc31df32445fc98d4ccd8365
由于SushiSwap:INV（INV-ETH Pair）的流动性非常低，用300ETH（价值约一百多万美元）换取INV将大幅增加INV价格。
随后，攻击者正式发起攻击:
1. 攻击者把在准备阶段获得的INV存入，并铸造（mint）了1746枚XINV代币。
2. XINV的价格计算：根据SushiSwap:INV对中的INV价格所计算。如上所述，INV的价格被操纵，因此每XINV的价值为20926美元。
3. 随着XINV的价格被修改，攻击者能够用铸造的XINV代币借用到如下资产：1588枚ETH，94枚WBTC，3999669枚DOLA与39枚YFI。
合约漏洞分析
该漏洞主要原因是对价格预言机具有依赖性，并且这中间有30分钟的窗口期。而攻击在准备阶段完成后正式发生，仅仅用了15秒。

在这种情况下，因为timeElapsed == 15，预言机合约Keep3rV2Oracle的函数_update()中'timeElapsed > periodSize'的检查将被绕过。这意味着最后的累积价格还没有被更新。由此可见，函数_computeAmountOut()中的amoutOut会比预期的数额大，因为priceCumulative已经被操纵了，但_observation.priceCumulative没有被更新。

一方面，XINV的价格依赖于SushiSwap:INV 对（INV-ETH对）的储备，其流动性非常低。
另一方面，TWAP可以防止闪电贷攻击。理论上，攻击者能够通过 "牺牲 "一些钱来操纵价格，也就是说，用他自己的钱来改变价格。在这个特殊的价格预言机设计中，如果经过的时间没有超过30分钟，当前的价格（来自储备金）不应该被用来计算出金金额。
资产追踪
据CertiK SkyTrace显示，价值约1450万美元的资产被盗后已被转移到Tornado Cash。

其他细节
利用漏洞进行交易的准备期间:
https://etherscan.io/tx/0x20a6dcff06a791a7f8be9f423053ce8caee3f9eecc31df32445fc98d4ccd8365
利用漏洞进行交易发起攻击:
https://etherscan.io/tx/0x600373f6752132https://etherscan.io/tx/0x600373f67521324c8068cfd025f121a0843d57ec813411661b07edc5ff781842
攻击者地址1:https://etherscan.io/address/0x117c0391b3483e32aa665b5ecb2cc539669ea7e9
攻击者地址2: https://etherscan.io/address/0x8b4c1083cd6aef062298e1fa900df9832c8351b3
攻击合约:
https://etherscan.io/address/0xea0c959bbb7476ddd6cd4204bdee82b790aa1562
预言机合约:
https://etherscan.io/address/0x39b1df026010b5aea781f90542ee19e900f2db15#code
SushiSwap INV-ETH Pair:
https://etherscan.io/address/0x328dfd0139e26cb0fef7b0742b49b0fe4325f821
XINV 合约地址: https://etherscan.io/address/0x1637e4e9941d55703a7a5e7807d6ada3f7dcd61b#code
Keep3rV2 预言机合约地址:
https://etherscan.io/address/0x39b1df026010b5aea781f90542ee19e900f2db15#code
写在最后
现如今，很多项目都会用到预言机，部分项目还会对其具有很强的依赖性。安全审计，会审查预言机的设计合理性、价格算法以及经济模型等。
因此，CertiK的安全专家建议：尽量避免使用流动性低的池子作为价格预言机价格来源，同时对项目进行安全审计从而保证预言机模型的正确性。

Пов'язані матеріали

From Sand to Chips: Hefei's Semiconductor Alchemy

From Sand to Chips: Hefei's Semiconductor "Alchemy" On July 27, 2026, a memory chip maker from Hefei made history by surpassing the market capitalization of Industrial and Commercial Bank of China on its Shanghai Stock Exchange debut. This marks the culmination of Hefei's two-decade industrial transformation, often summarized in three strategic leaps: "Screen, Chip, Vehicle." The journey began in 2008 with a bold investment in BOE, establishing China's first 6th-generation LCD panel line. The second leap was the "Project 506" in 2016, which gave birth to ChangXin Memory Technologies (CXMT). With initial backing of 14.4 billion RMB from Hefei's state-owned investment platform, CXMT aimed to break into the global DRAM market, then over 95% controlled by three overseas giants. CXMT achieved a breakthrough in 2019 by producing China's first 8GB DDR4 DRAM chip, employing "generational leapfrog" R&D to catch up. After years of significant losses, the company turned profitable in 2025. A dramatic surge followed in 2026, driven by AI-driven demand and full capacity utilization, propelling CXMT to become the world's fourth-largest DRAM manufacturer. CXMT's success is not isolated. It anchors a dense, localized semiconductor ecosystem in Hefei. Within its vicinity are numerous supporting companies for equipment, materials, and packaging & testing. This cluster has fueled the regional economy, with Hefei's integrated circuit industry output growing over sevenfold between 2016 and 2025. The ripple effects extend beyond high-tech, revitalizing local communities with new businesses and services catering to the influx of workers. For individuals, Hefei offers competitive tech salaries at a significantly lower cost of living compared to major coastal cities, along with improved amenities and shorter commutes. Hefei's story demonstrates two decades of focused, long-term industrial policy, transforming the city from a provincial capital into a trillion-RMB GDP "Double Ten-Thousand" city (10 million people, 1 trillion RMB GDP). It shows how persistence in strategic sectors—turning sand into chips—can redefine a city's economic destiny.

marsbit4 хв тому

IMF Sounds Alarm: Why Brazil's Rapidly Developing Cryptocurrency Market Needs Urgent Regulation

The IMF has expressed alarm over Brazil's rapidly growing cryptocurrency market and the urgent need for its regulation. In its latest Financial System Stability Assessment report, the IMF highlighted the enormous expansion of crypto financial channels, which have surpassed traditional capital flows in volume since 2017, largely driven by stablecoins due to their efficiency and tax advantages. The report notes these flows are influenced by international indices, Bitcoin prices, and domestic factors like exchange rates and policy uncertainty. While acknowledging steps taken by Brazil's central bank to regulate Virtual Asset Service Providers (VASPs), the IMF points to critical gaps. These include insufficient customer legal protection, lack of asset segregation for custodial holdings, and incomplete implementation of international Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) standards, such as the full "travel rule." The urgency for action is heightened because Brazil's crypto ecosystem is deeply interconnected with its traditional financial system. To mitigate risks, the IMF calls for establishing a clear regulatory framework, implementing enhanced reporting protocols, and strengthening cooperation between national and international supervisory bodies.

cryptonews.ru6 хв тому

IMF Sounds Alarm: Why Brazil's Rapidly Developing Cryptocurrency Market Needs Urgent Regulation

cryptonews.ru6 хв тому

Strive Increases Its Corporate Bitcoin Reserve to 20,000 Bitcoins

Strive has increased its corporate Bitcoin reserve to 20,000 BTC. Between July 20-24, the company acquired 79 bitcoins for approximately $5.2 million at an average price of $65,723 per coin, bringing the total value of its holdings to around $1.3 billion at current prices. The funding primarily comes from the issuance of its SATA preferred perpetual shares, whose dividend yield was recently raised to about 13%. This marks the fourth consecutive week of Strive increasing its Bitcoin reserves. Since May, the company has added approximately 3,264 BTC to its portfolio through market purchases and corporate deals. Consequently, SATA shares have risen by over 10% in the past month. A major purchase this year occurred in May, when Strive bought more than 2,500 BTC for about $185.2 million at an average price of $74,092 per coin. Subsequent smaller purchases were made at lower prices. Year-to-date, Strive has increased its holdings by 3,780 BTC. The company now ranks seventh among public companies by Bitcoin treasury size, positioned between Bullish and Elon Musk's SpaceX. Strive's ongoing acquisitions contrast with the largest corporate holder, Strategy, which has paused its Bitcoin purchases for a month and recently conducted its first buyback of preferred shares.

cryptonews.ru9 хв тому

Strive Increases Its Corporate Bitcoin Reserve to 20,000 Bitcoins

cryptonews.ru9 хв тому

Some Go Bankrupt, Others Go Shopping: The Counter-Cyclical Acquisition Logic of MoonPay, Circle, and Kraken

During a period of market stress where multiple crypto firms filed for bankruptcy or shut down, three major companies—MoonPay, Circle, and Kraken—pursued strategic acquisitions to strengthen their positions. Their divergent strategies reflect differing dependencies on key unresolved industry questions: which trading platforms, public blockchains, and stablecoins will ultimately dominate. MoonPay, operating at the fiat-crypto gateway, acquired Glide to expand its capabilities in token swaps, cross-chain operations, and financial reconciliation. Its business model is not tied to any single blockchain or stablecoin, allowing it to profit from user activity across various platforms. Circle, facing competitive pressure from the new Open Dollar Standard (OUSD) which could erode its core revenue from USDC reserve interest, acquired nearly a thousand patents from IBM. This move aims to build a competitive moat around USDC by enhancing its enterprise infrastructure, banking integrations, and compliance tools, shifting competition beyond mere interest yields. Kraken acquired Magic Labs' wallet-as-a-service business to deepen its integrated trading platform. The goal is to create a seamless "universal account" where users can trade crypto, stocks, and tokenized assets without leaving Kraken's ecosystem, while also bolstering its own layer-2 blockchain, Ink. These acquisitions highlight a trend where leading firms are consolidating core infrastructure not just for immediate profits, but to secure their futures amid ongoing industry consolidation and uncertainty. The competitive battleground is shifting from basic infrastructure access to superior product integration and ecosystem scale.

marsbit10 хв тому

Some Go Bankrupt, Others Go Shopping: The Counter-Cyclical Acquisition Logic of MoonPay, Circle, and Kraken

marsbit10 хв тому

The Permanent Underclass: No One Can Answer That 17-Year-Old Child

The article "The Permanent Underclass: No One Has an Answer for That 17-Year-Old" explores the concept of a "permanent underclass" emerging in a future where AI can perform most cognitive and physical labor. This theory, gaining traction in tech circles, suggests that as AI reduces the need for human workers, wages lose importance, and wealth increasingly flows to those who own AI models, compute, and data. The core issue is not temporary poverty but the potential breakdown of the traditional ladder of upward mobility—through labor, bargaining, and asset accumulation—making "underclass" a permanent status. The piece highlights a poignant question posed by researcher Jasmine Sun to AI lab personnel: What advice would you give a typical 17-year-old facing this future? Most had no answer, acknowledging the frightening transition ahead. However, while struggling to advise others, many in the AI field are securing their own positions, shifting from research or policy into labs to gain equity and stand on the "capital" side. This creates a vicious cycle: the more people believe labor's bargaining power is vanishing, the fewer work to rebuild it, accelerating its decline. Common personal survival strategies—learning AI skills, acquiring AI company equity, or pivoting to hands-on, in-person work—are analyzed. The author argues these are largely stopgaps, accessible mainly to the privileged, and may collectively undermine labor's overall position. The fundamental question shifts from "how not to fall behind" to "why must one's survival depend on being needed by capital?" The article concludes that the real solution is not individual adaptation but building a new societal "negotiating table"—new laws, forms of collective bargaining, or redistribution mechanisms (like taxes or public funds) to ensure the wealth AI creates is shared, especially with those displaced. It contrasts tentative institutional responses in China with a potential regulatory vacuum in the US, warning that without such frameworks being established before public frustration boils over, social unrest could follow. The 17-year-old’s dilemma underscores a systemic failure: the architects of this future are buying personal insurance but offering no collective answers.

marsbit18 хв тому

The Permanent Underclass: No One Can Answer That 17-Year-Old Child

marsbit18 хв тому

Торгівля

Спот