On September 26, 2024, the Bedrock DeFi protocol, a liquid restaking platform, was attacked, resulting in an approximate $1.7M loss on the Ethereum mainnet.

<p>On September 26, 2024, the Bedrock DeFi protocol, a liquid restaking platform, was attacked, resulting in an approximate $1.7M loss on the Ethereum mainnet. The hack targeted the Vault contract, which controls the minting of the uniBTC token.</p><h2>Overview</h2><p>Attacker: <a href="https://etherscan.io/address/0x2bfb373017349820dda2da8230e6b66739be9f96" rel="nofollow">https://etherscan.io/address/0x2bfb373017349820dda2da8230e6b66739be9f96</a></p><p>Vulnerable Contract: <a href="https://etherscan.io/address/0x047d41f2544b7f63a8e991af2068a363d210d6da" rel="nofollow">https://etherscan.io/address/0x047d41f2544b7f63a8e991af2068a363d210d6da</a></p><p>Transaction attack: <a href="https://etherscan.io/tx/0x725f0d65340c859e0f64e72ca8260220c526c3e0ccde530004160809f6177940" rel="nofollow">https://etherscan.io/tx/0x725f0d65340c859e0f64e72ca8260220c526c3e0ccde530004160809f6177940</a></p><h2>Exploit Analysis</h2><p>Looking at the exploit transaction, we can observe that after borrowing 30.8 WETH from the Balancer Vault using flashloan, the attacker's contract converted it all to native ETH and transferred it to Bedrock DeFi's Vault contract, ultimately leading to the minting of 30.8 uniBTC tokens.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F663efbe0-5290-4060-8afd-8c1e363e7178_1532x654.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/4e033e59667295a8ec0773d16ffeac42.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>Checking the source code of the Vault contract, we can clearly see that this contract expects the native token to be BTC. However, since this contract is deployed on the Ethereum chain, it produces an incorrect conversion ratio (1:1) between uniBTC and ETH, which is a simple but critical error.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fcb97a8ca-55a9-4980-b33a-6075aa4ebf12_392x159.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/053910ec665abe0905f32d4cae27b837.jpg" alt=""></source></picture><div></div></div></a></figure></div><h2>Lesson learned</h2><p>For contracts that control the minting or holding of tokens, even a minor error can result in significant security vulnerabilities. Therefore, conducting a security audit before deploying contracts in the production environment is critically important.</p>

Bedrock DeFi incident analysis

在2024年9月26日,Bedrock DeFi协议,一个流动性重新质押平台,遭到攻击,导致在以太坊主网上损失约170万美元。

<p>2024 年 9 月 26 日，流动性再抵押平台 Bedrock DeFi 协议遭到攻击，导致以太坊主网损失约 170 万美元。此次黑客攻击的目标是控制 uniBTC 代币铸造的 Vault 合约。</p><h2>概述</h2><p>攻击者： <a href="https://etherscan.io/address/0x2bfb373017349820dda2da8230e6b66739be9f96" rel="nofollow">https</a> ://etherscan.io/address/0x2bfb373017349820dda2da8230e6b66739be9f96</p><p>易受攻击的合约： <a href="https://etherscan.io/address/0x047d41f2544b7f63a8e991af2068a363d210d6da" rel="nofollow">https</a> ://etherscan.io/address/0x047d41f2544b7f63a8e991af2068a363d210d6da</p><p>交易攻击： <a href="https://etherscan.io/tx/0x725f0d65340c859e0f64e72ca8260220c526c3e0ccde530004160809f6177940" rel="nofollow">https</a> ://etherscan.io/tx/0x725f0d65340c859e0f64e72ca8260220c526c3e0ccde530004160809f6177940</p><h2>漏洞分析</h2><p>查看漏洞交易，我们可以观察到，在使用闪电贷从 Balancer Vault 借入 30.8 WETH 后，攻击者的合约将其全部转换为原生ETH ，并将其转移到 Bedrock DeFi 的 Vault 合约，最终导致铸造了 30.8 个 uniBTC 代币。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F663efbe0-5290-4060-8afd-8c1e363e7178_1532x654.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/4e033e59667295a8ec0773d16ffeac42.jpg" alt=""></source></picture><div></div></div></figure></div><p>查看 Vault 合约的源代码，我们可以清楚地看到，该合约期望原生代币为BTC。 但是，由于此合约部署在以太坊链上，它产生了 uniBTC 和ETH之间的错误转换比率（1：1），这是一个简单但关键的错误。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fcb97a8ca-55a9-4980-b33a-6075aa4ebf12_392x159.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/053910ec665abe0905f32d4cae27b837.jpg" alt=""></source></picture><div></div></div></figure></div><h2>经验教训</h2><p>对于控制代币铸造或持有的合约来说，即使是很小的错误也可能导致严重的安全漏洞。因此，在生产环境部署合约之前进行安全审计至关重要。</p>

基岩DeFi事件分析

Memecoin的狂热与当前极低的代币发行门槛密不可分。只需要几美元甚至免费就能发币，这也导致每天上万种新代币被发行，加剧了PVP。每当一个热点出来，各种概念币都会立即出现，包括各种NEIRO币（大小写），川普概念币等等。
由此，各种诈骗，各种拉高割韭菜的情况比比皆是。
昨天晚上就出现了一个很有代表性的割韭菜项目——SHARPEI（$SHAR）。
据 Cointelegaraph 在开盘后发布的一...

从6000万美元到1百万美元，从万人追捧到万人唾骂，$SHAR 只用了7个小时

大型山寨币季从今天开始了
山寨币指标三年来首次呈现抛物线式上涨。
还记得2021年吗？那时，我的投资组合在一个月内从900美元飙升到14.5万美元。
这次，我将通过这些低调的山寨币赚得更多。
每个市场阶段都受到资金流入的影响，而资金流入遵循着所有市场中一致的周期，包括加密市场。
我们已经看到资金从比特币（$BTC）流向大市值代币，不久，这一重要的流动性转移也将波及小市值代币。
2024-2025周...

牛市来临前不容错过的百倍价值币

教AI启动一个Meme币很简单，但注入灵魂的人还得是人。