DEUS Finance DAO被盗1570万美元攻击事件分析

CertikОпубліковано о 2022-04-28Востаннє оновлено о 2022-04-28

Анотація

DEUS Finance被恶意利用，造成了约1570万美元（折合人民币约1.03亿）的损失。

北京时间2022年4月28日10:40:14 ，CertiK审计团队监测到DEUS Finance的合约被恶意攻击，造成了约1570万美元（折合人民币约1.03亿）的损失。
攻击者恶意操纵DEI的价格，从DeiLenderSolidex合约中通过提供少量的抵押品提取了大量的DEI。
漏洞交易
https://ftmscan.com/tx/0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5
攻击步骤
①攻击者部署攻击合约并向借贷池DeiLenderSolidex合约提供抵押。②随后攻击者利用攻击合约获得了超过143,200,000 USDC用以发起攻击。
③攻击合约将这143,200,000 个借得的USDC在USDC/DEI交易对池0x5821573中换为9,547,716个DEI，此举导致DEI的价格被大幅提高。
④由于DeiLenderSolidex合约是用预言机来确定用户抵押品的价值，而预言机合约使用被恶意操纵的交易对池的价格作为价格来源。因此通过提高的价格和之前提供的抵押，攻击者可从借贷池（DeiLenderSolidex）中总计借贷到17,246,885 DEI，这一数额远大于之前攻击者提供抵押的金额。

⑤攻击者用9,547,716个 DEI交换到的143,184,725 USDC来偿还闪电贷款，最终获取差价离场。

漏洞分析

通过闪电贷，攻击者能够操纵交易对的状态，并进一步操纵DEUS的预言机价格，以此利用不对等的价值借贷DEI。
资产去向
截至撰稿时，黑客已将攻击所得转到以太坊上并换成ETH，随后将5,446个ETH（总价值约1570万美元）存入Tornado Cash。https://debank.com/profile/0x701428525cbac59dae7af833f19d9c3aaa2a37cb/history
写在最后
预言机合约不应该直接使用交易对池中的价格作为价格来源，而安全审计可以有效地避免这一风险。CertiK安全专家建议：如果只有代币合约被审计，这种情况在审计过程中将会指出第三方依赖风险。项目应该避免直接从交易对池中获取价格。建议根据项目的逻辑，使用更值得信任的预言机：1. 使用多个可靠的链上价格预言机来源，例如Chainlink和Band协议。
2. 使用时间加权平均价格（TWAP）。TWAP代表了一个代币在特定时间范围内的平均价格。因此如果攻击者仅操纵一个区块的价格并不会对平均价格产生太大的影响。
3. 如果合约模式允许，将函数调用者限制在一个非合约/EOA地址。
4. 闪电贷款只允许用户在一次交易中进行借贷。如果合约用例允许，可强制关键交易至少跨越两个区块。

Пов'язані матеріали

Bitfinex: July 2026 was the worst month for Bitcoin in the past two years

Bitcoin experienced its worst month in two years in July 2026, according to Bitfinex. Market activity plummeted to its lowest level since November 2023, with daily trading volume falling to around $4.5 billion, far below February's peak of $16.5 billion. Average daily spot trading volume for Bitcoin dropped to $2.2 billion, a 1.5-year low as reported by K33. Open interest for Bitcoin futures on the CME also declined significantly, nearing multi-year lows. The volume of open perpetual swap contracts stabilized around 300,000 BTC, indicating a lack of speculative demand. Analysts attribute the downturn to seasonal factors, as July and August are traditionally low-volatility months with reduced activity. The situation is further exacerbated by major investors' caution due to uncertainty surrounding the upcoming US Federal Reserve decision on interest rates. In related news, the largest corporate Bitcoin holder, Strategy, has not added to its BTC balance for five consecutive weeks while increasing its dollar reserves to $3.75 billion through stock sales.

cryptonews.ru5 хв тому

Bitfinex: July 2026 was the worst month for Bitcoin in the past two years

cryptonews.ru5 хв тому

Wall Street Morning Report: Fed Holds Steady, Nasdaq Falls for 6th Straight Day, Memory Stocks Plunge for 4th Day, Philly Semiconductor Index Down Nearly 30% from Peak

Wall Street Morning Report: Major indices plummeted amid geopolitical tensions, a hawkish Fed split, and shaken AI confidence. The Dow Jones saw its largest single-day point drop since April 2025, while the Nasdaq closed lower for a sixth consecutive session. The Fed held rates steady, but a rare three dissenting votes calling for a hike signaled significant internal hawkish pressure. Chair Warsh reaffirmed a hard line on inflation above 2% and scrapped forward guidance, pushing market expectations for a September rate hike above 65%. Long-term Treasury yields, especially the 30-year, surged to multi-decade highs as investors demanded higher inflation risk premiums. The chip sector was hammered, with the Philadelphia Semiconductor Index falling into a bear market, down nearly 29% from its peak. Storage stocks like Micron plunged for a fourth day, and data showed retail investors executed their largest net stock sell-off since early 2020, heavily targeting chip names. In earnings, Microsoft beat expectations while Meta's weak guidance sparked a sell-off. Oil prices jumped nearly 8% as U.S.-Iran hostilities reignited. Key upcoming events include U.S. Q2 GDP and core PCE data, along with earnings from Apple and Amazon.

marsbit25 хв тому

Wall Street Morning Report: Fed Holds Steady, Nasdaq Falls for 6th Straight Day, Memory Stocks Plunge for 4th Day, Philly Semiconductor Index Down Nearly 30% from Peak

marsbit25 хв тому

Luno cuts 20% of staff as crypto layoffs spread across 12 firms in July

Crypto exchange Luno is cutting 20% of its global workforce to restructure operations and focus more on institutional clients and B2B services. CEO James Lanigan cited investments in automation and operational improvements as changing the company's needs. This is Luno's second major round of layoffs, having cut 35% of staff in early 2023. The company, serving 16 million users, is part of a wider industry trend where crypto firms cite AI and automation for job cuts. In July alone, layoffs or restructuring affected 12 crypto and adjacent companies, impacting 894 jobs according to CryptoJobsList. The tracker has recorded over 7,254 disclosed job cuts across 47 companies in 2026, with market conditions being the most common reason. Other firms like Exodus and Gnosis have also recently announced staff reductions, highlighting the ongoing challenges in the crypto sector.

cointelegraph50 хв тому

Luno cuts 20% of staff as crypto layoffs spread across 12 firms in July

cointelegraph50 хв тому

AI is Killing 'Poor People's Entertainment'

AI Is Eliminating 'Entertainment for the Poor' This article discusses the rising cost of video gaming, arguing that AI is making digital entertainment increasingly expensive. It follows the example of a frugal gamer who, accustomed to waiting for discounts and buying second-hand games, now faces a new reality. Video game consoles like the PS5 Pro and Switch 2 are increasing in price post-launch, breaking the traditional pattern of降价 over time. Game prices are also rising, with major titles like GTA 6 launching at $80. Furthermore, the industry is moving towards eliminating physical media, exemplified by Sony's plan to stop PS disc production by 2028. This shift blocks the二手 market, a key cost-saving avenue for players. Even Valve's anticipated affordable Steam Machine launched with a high price and disappointing specs. Manufacturers cite inflation, supply chain issues, and rising development costs, but a core driver is the AI boom. AI data centers now consume semiconductor and memory resources once prioritized for consumer electronics like game consoles. This competition from a more profitable sector drives up hardware costs. Additionally, developing modern AAA games with massive teams over many years is astronomically expensive, pushing publishers towards digital-only distribution and subscription models to secure recurring revenue. The article suggests this trend extends beyond gaming. Video streaming, music platforms, cloud storage, and AI tools are increasingly locked behind complex subscription tiers. While AI promises future benefits, it is currently making digital entertainment and services more costly. The era of progressively cheaper, accessible online entertainment is ending, forcing consumers to pay more upfront for future technological promises.

marsbit54 хв тому

AI is Killing 'Poor People's Entertainment'

marsbit54 хв тому

The Demise of the Trillion-HKD ETF Myth: SK Hynix Plummets, Hong Kong Switches from 'Double Leverage' to 'Flexible Leverage', South Korea Restricts Leveraged ETF Investments

South Korea's AI-driven bull market has taken a sharp downturn, severely impacting SK Hynix's stock and prompting regulatory tightening in both Hong Kong and South Korea on single-stock leveraged products. The CSOP SK Hynix Daily Leveraged (2x) ETF, once the world's largest single-stock leveraged ETF with over HKD 130 billion in assets, saw its value plummet by over 80% as SK Hynix shares fell nearly 46% from their June peak, erasing more than HKD 100 billion. In response, Hong Kong's Securities and Futures Commission (SFC) revised its regulatory framework. Starting August 3rd, fixed 2x leverage for single-stock leveraged and inverse products will shift to a dynamic "flexible leverage" mechanism, where daily leverage can vary up to a maximum of 2x. This aims to balance market development with investor protection but has sparked debate about changes to the products' core features and potential reduced appeal for risk-seeking investors. Simultaneously, South Korean authorities announced plans to further restrict single-stock leveraged ETFs following two consecutive days of market circuit breakers. Proposed measures include capping individual investors' allocations to such products at 20% of their total financial investment assets, increasing trading costs, and enhancing suitability requirements. The Finance Minister publicly apologized, acknowledging insufficient initial risk assessment. Analysts note that while the long-term fundamentals for South Korean semiconductor firms like SK Hynix remain solid, short-term market volatility is heightened due to concentrated leveraged bets and shifting global risk sentiment. The regulatory moves in both markets signal a clear shift from encouraging innovation towards prioritizing risk control, reminding investors of the amplified risks inherent in leveraged products.

marsbit1 год тому

The Demise of the Trillion-HKD ETF Myth: SK Hynix Plummets, Hong Kong Switches from 'Double Leverage' to 'Flexible Leverage', South Korea Restricts Leveraged ETF Investments

marsbit1 год тому

Торгівля

Спот