avatar
Phalcon
148 Twitter followers
Follow
Security Development Suite for DeFi Projects. Powered by @BlockSecTeam Phalcon Browser: http://phalcon.xyz
Posts
avatar
Phalcon
.@DriftProtocol on #Solana was exploited several hours ago. According to its public statement, this incident was not caused by a bug in its programs or smart contracts, and there is no evidence of compromised seed phrases. The attacker appears to have tricked multisig signers into approving durable-nonce pre-signatures, enabling admin takeover and parameter abuse. Specifically, the attacker obtained approvals through phishing or misleading signing flows and prepared malicious admin-transfer transactions in advance. At execution, the attacker sent a transaction beginning with AdvanceNonceAccount, which advanced the durable nonce and enabled delayed execution of the pre-signed flow on-chain, rather than expiring like a standard recent-blockhash transaction. The flow then proceeded through proposalApprove and vaultTransactionExecute, triggered UpdateAdmin, and completed the admin takeover. After that, the attacker: 1. created a malicious or illiquid collateral market, identified on-chain as CVT, with permissive risk parameters; 2. switched to an attacker-controlled oracle and inflated CVT pricing; 3. raised or removed withdrawal guardrails across major real-asset markets. The attacker then posted large amounts of CVT as collateral, borrowed against the inflated value, and withdrew real assets including USDC, wETH, dSOL, JLP, and cbBTC. Based on currently traceable on-chain activity, this was the primary value-extraction path. The current loss estimate is $285,279,417. Admin transfer transaction: solscan.io/tx/4BKBmAJn6TdsENij...… Loss-tracking reference: solscan.io/account/HkGz4KmoZ7Z...… twitter.com/Phalcon_xyz/status...
SOL
0.57%
avatar
Phalcon
03-10
ALERT! Our system detected a suspicious transaction targeting the MT–WBNB pool on #BSC hours ago, resulting in an estimated loss of ~$242K. The root cause stems from a flawed buyer-limitation mechanism: in deflation mode normal buys revert while router/pair are whitelisted, allowing the attacker to bypass restrictions via router swaps and liquidity removal to obtain MT from the pair. The attacker then sold MT to accumulate pendingBurnAmount and called distributeFees() to burn MT directly from the pair, artificially pumping the price before swapping MT back to WBNB for profit. Additionally, a referral rule allowing the first 0.2 MT transfer to bypass buyer limits enabled the attacker to bootstrap the attack. Attack TX: app.blocksec.com/phalcon/explo...… 🟦 Found by #PhalconSecurity, 🟦 Analyzed via #PhalconExplorer.
ALE
0.04%
avatar
Phalcon
03-06
The @SolvProtocol BitcoinReserveOffering contract was reportedly exploited, resulting in a loss of ~$2.7M. The root cause is a reentrancy issue caused by an unintended interaction between mint() and the ERC721 receiver callback. When redeeming the entire value of an ERC-3525 SFT, the contract transferred the SFT via safeTransferFrom (doSafeTransferIn), triggering onERC721Received. The callback immediately minted BRO based on the SFT value. After returning, mint() resumed and minted BRO again for the same value, effectively double-counting the asset. By repeatedly cycling burn → mint, the attacker amplified their BRO balance, inflating a small initial amount into a large supply and ultimately exchanging it for SolvBTC to realize the profit. Attack TX: app.blocksec.com/phalcon/explo...… twitter.com/Phalcon_xyz/status...
BRO
1.1%
loading indicator
Loading..