DEUS Finance DAO被盗1570万美元攻击事件分析

CertikОпубліковано о 2022-04-28Востаннє оновлено о 2022-04-28

Анотація

DEUS Finance被恶意利用，造成了约1570万美元（折合人民币约1.03亿）的损失。

北京时间2022年4月28日10:40:14 ，CertiK审计团队监测到DEUS Finance的合约被恶意攻击，造成了约1570万美元（折合人民币约1.03亿）的损失。
攻击者恶意操纵DEI的价格，从DeiLenderSolidex合约中通过提供少量的抵押品提取了大量的DEI。
漏洞交易
https://ftmscan.com/tx/0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5
攻击步骤
①攻击者部署攻击合约并向借贷池DeiLenderSolidex合约提供抵押。②随后攻击者利用攻击合约获得了超过143,200,000 USDC用以发起攻击。
③攻击合约将这143,200,000 个借得的USDC在USDC/DEI交易对池0x5821573中换为9,547,716个DEI，此举导致DEI的价格被大幅提高。
④由于DeiLenderSolidex合约是用预言机来确定用户抵押品的价值，而预言机合约使用被恶意操纵的交易对池的价格作为价格来源。因此通过提高的价格和之前提供的抵押，攻击者可从借贷池（DeiLenderSolidex）中总计借贷到17,246,885 DEI，这一数额远大于之前攻击者提供抵押的金额。

⑤攻击者用9,547,716个 DEI交换到的143,184,725 USDC来偿还闪电贷款，最终获取差价离场。

漏洞分析

通过闪电贷，攻击者能够操纵交易对的状态，并进一步操纵DEUS的预言机价格，以此利用不对等的价值借贷DEI。
资产去向
截至撰稿时，黑客已将攻击所得转到以太坊上并换成ETH，随后将5,446个ETH（总价值约1570万美元）存入Tornado Cash。https://debank.com/profile/0x701428525cbac59dae7af833f19d9c3aaa2a37cb/history
写在最后
预言机合约不应该直接使用交易对池中的价格作为价格来源，而安全审计可以有效地避免这一风险。CertiK安全专家建议：如果只有代币合约被审计，这种情况在审计过程中将会指出第三方依赖风险。项目应该避免直接从交易对池中获取价格。建议根据项目的逻辑，使用更值得信任的预言机：1. 使用多个可靠的链上价格预言机来源，例如Chainlink和Band协议。
2. 使用时间加权平均价格（TWAP）。TWAP代表了一个代币在特定时间范围内的平均价格。因此如果攻击者仅操纵一个区块的价格并不会对平均价格产生太大的影响。
3. 如果合约模式允许，将函数调用者限制在一个非合约/EOA地址。
4. 闪电贷款只允许用户在一次交易中进行借贷。如果合约用例允许，可强制关键交易至少跨越两个区块。

Пов'язані матеріали

U.S. Treasury imposes sanctions on Iranian insurers accepting Bitcoin

The US Treasury Department's Office of Foreign Assets Control (OFAC) has imposed sanctions on two Iranian marine insurance firms, Persian Gulf Marine Insurance Company and HormuzSafe Marine Services Authority. These companies, allegedly controlled by Iran's Islamic Revolutionary Guard Corps, are accused of using cryptocurrencies like Bitcoin to circumvent US sanctions. The US government states these firms force commercial vessels to purchase mandatory insurance for passage through the Strait of Hormuz while Iran itself creates the primary risks, including ship seizures. US Treasury Secretary Scott Bessent emphasized that the US will not allow Iran to hold global trade hostage or finance terrorism. The sanctions also target eight vessels in Iran's "shadow fleet" involved in transporting oil and petrochemicals. This action is part of broader US pressure on Iran's key economic sectors.

cryptonews.ru8 хв тому

U.S. Treasury imposes sanctions on Iranian insurers accepting Bitcoin

cryptonews.ru8 хв тому

Russian man loses over 2.3 million rubles due to cryptocurrency scammers

In May, a 45-year-old man from Ugolnye Kopi met a woman on a dating app. She suggested he invest in cryptocurrency, promising stable returns. Initially refusing, he later changed his mind. In early summer, she connected him with someone posing as an investment specialist. This person explained a method of profiting from digital assets: buy during a price rise and sell at the peak. The victim was convinced to install a fake crypto exchange app on his phone. To gain his trust, the scammers first let him invest small sums—from 1,000 to 10,000 rubles—and showed fake profits. When he invested 50,000 rubles, the promised profit never came. A fraudster then contacted him, claiming the transfer was mistakenly blocked and that law enforcement might get involved. Following this, the scheme's organizers urged the man to "resolve the situation" by sending more money. He made ten transfers to various bank accounts, the last being 500,000 rubles. He eventually realized it was a scam, ceased contact, deleted the app, and reported it to the police. A criminal case has been initiated. Previously, a resident of Kyzyl in the Republic of Tyva lost 5.5 million rubles in a similar crypto investment scam, most of which came from selling his own apartment.

cryptonews.ru9 хв тому

Russian man loses over 2.3 million rubles due to cryptocurrency scammers

cryptonews.ru9 хв тому

Observation of Data on the Top Six Cryptocurrency Protocols: Revenue Continues to Grow, So Why Aren't Token Prices Rising?

Despite generating impressive revenue, many top cryptocurrency protocols struggle to translate this success into token price appreciation. This analysis of six major protocols (Aave, Aerodrome, Hyperliquid, Pump, Sky, Uniswap) examines the disconnect, focusing on revenue generation, distribution, and tokenomics. While these protocols collectively earned over $726 million in the first half of 2026, token performance largely lagged due to factors like imbalanced token emissions, unclear value capture mechanisms, and equity-token separations that disadvantage holders. Key findings reveal that not all revenue is equal for token holders. Protocols differ significantly in how they allocate income. Hyperliquid, for instance, directs 100% of its revenue to holders via buybacks and burns, correlating with strong token performance. Others, like Aerodrome, Sky, and Uniswap, showed negative net token flows when accounting for high token emissions used for incentives, offsetting holder benefits. The article highlights two primary value capture methods: buybacks/burns and direct fee distribution (e.g., ve-tokenomics models). The analysis concludes that high revenue alone doesn't guarantee token growth. Investors must scrutinize a protocol's sustainable revenue sources, how that value is shared with token holders, and the associated token release schedules and supply pressures. The future points towards greater alignment between protocol success and tokenholder rewards, but only for projects that seriously address all three pillars: revenue, distribution, and emissions.

marsbit38 хв тому

Observation of Data on the Top Six Cryptocurrency Protocols: Revenue Continues to Grow, So Why Aren't Token Prices Rising?

marsbit38 хв тому

September 1st, A Major Chip Price Hike

On July 29, 2026 (US time), Qualcomm reported its Q3 FY2026 (Q2 CY) results. Revenue reached $9.95 billion, up 4% and beating estimates, but net profit fell 25% YoY to $2 billion. The "revenue up, profit down" trend is attributed to rising costs across semiconductor manufacturing, testing, packaging, and materials. In response, CEO Cristiano Amon announced price increases for all chip products, effective September 1, to pass on costs and restore historical profit margins. The stock fell over 5% in after-hours trading due to weaker-than-expected Q4 profit guidance. Qualcomm's core chip business (QCT) revenue was $8.5 billion, down 5% YoY. Handset revenue dropped 20% to $5.09 billion, reflecting a weak global smartphone market with declining shipments. In contrast, Automotive revenue surged 61% to $1.59 billion, marking 23 consecutive quarters of double-digit growth, and IoT revenue grew 9% to $1.83 billion. The licensing division (QTL) revenue was $1.28 billion, down 3%. Facing smartphone headwinds and a reduced component share in future iPhones, Qualcomm is aggressively diversifying. It is betting heavily on the data center AI market, maintaining a target of $5 billion in data center revenue for FY2027. The company completed the acquisition of AI software firm Modular to build an open software platform for generative AI. For Q4 FY2026, Qualcomm forecasts revenue between $9.7B and $10.5B, roughly in line with expectations. However, non-GAAP EPS guidance of $2.05-$2.25 fell short of the $2.36 analyst consensus. Management expects the chip price increases to gradually improve margins after September 1, but near-term profitability pressure from costs and the weak handset market persists.

marsbit38 хв тому

marsbit38 хв тому

Prediction Markets Surpassed Cryptocurrencies: Robinhood Earned $1.31 Billion in Q2

Robinhood posted record Q2 2026 revenue of $1.31 billion and net income of $573 million. Notably, nearly 23% of the profit came from one-time items, primarily the deconsolidation of a ventures fund. A key shift was the explosive growth of its prediction markets business, with event contract revenue surging over 10x year-over-year to $156 million, surpassing revenue from stocks ($129M) and cryptocurrencies ($100M). Cryptocurrency revenue declined 38% organically, but the company is aggressively expanding its crypto infrastructure through acquisitions, launching its own blockchain (Robinhood Chain), and offering new products like tokenized stocks and perpetual futures. Overall transaction revenue grew 44% to $776 million, with options remaining the largest single component at $342 million.

cryptonews.ru1 год тому

Prediction Markets Surpassed Cryptocurrencies: Robinhood Earned $1.31 Billion in Q2

cryptonews.ru1 год тому

Торгівля

Спот