According to TechFlow TechFlow, on December 5th, CertiK Alert reported that a USPD contract attack resulted in losses of approximately $1 million. The attackers manipulated stored data to carry out the attack, which lasted two months.
Analysis suggests the attack was divided into two phases: On September 16, the attacker preemptively executed a legitimate initialization transaction, adding a malicious intermediary proxy to the USPD stabilizer; on September 17, the attacker granted privileged roles to its contract through the malicious proxy, and then used those privileges to launch an attack 78 days later.
Previous reports indicated that the USPD protocol suffered a sophisticated attack that resulted in the loss of approximately 232 stETH, with the attackers reportedly minting 98 million USPD tokens.
