What? Vyper is a programming language designed for creating smart contracts on blockchain platforms. Inspired by Python, Vyper adopts a user-friendly and easily readable syntax, making it accessible t...

<div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6bdce2d0-124f-4be9-9ab9-f0c76b6cb5a3_533x128.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6da0dbbd779db4dba51d87c5b0a9c56e.jpg" alt="" title=""></source></picture><div></div></div></a><figcaption>Image 1: Vyper tweet</figcaption></figure></div><h1>What?</h1><p><strong>Vyper</strong> is a programming language designed for creating smart contracts on blockchain platforms. Inspired by Python, Vyper adopts a user-friendly and easily readable syntax, making it accessible to developers of all levels.</p><p><strong>Curve Pool</strong> is a decentralized finance (DeFi) protocol that revolutionizes stablecoin swapping on blockchain networks. As an automated market maker (AMM) optimized exclusively for stablecoins, Curve Pool ensures seamless and cost-effective exchanges between stable assets with minimal slippage and fees. Its unique algorithm is designed to minimize price impact during trades and maximize capital efficiency, making it a preferred choice for traders and liquidity providers seeking stablecoin liquidity.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div><h1>How?</h1><div><p><strong>“A number of stablepools (alETH/msETH/pETH) using Vyper 0.2.15 have been exploited as a result of a malfunctioning reentrancy lock. We are assessing the situation and will update the community as things develop.”</strong> - @CurveFinance</p></div><p>The attacks have occurred across various blockchain chains, resulting in a total loss of over $59 million. These losses are attributed to pools that use vulnerable versions of Vyper and contain ETH. Pools Hacked:</p><ul><li><p>CRV/ETH pool</p></li><li><p>alETH/ETH pool</p></li><li><p>msETH/ETH pool</p></li><li><p>pETH/ETH pool</p></li><li><p>…</p></li></ul><p>According to Curve Finance, there are still pools on Arbitrum that may be vulnerable. They advise users to remove liquidity as soon as possible for precautionary reasons.</p><p>In attacks, the attacker reentered the <strong>add_liquidity</strong> function after calling the <strong>remove_liquidity</strong> function. The states do not fully update before reentering the <strong>add_liquidity</strong> function, resulting in <strong>lp_price</strong> calculation error.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F612c059d-8333-4b25-bb08-1aa5029ec4c9_1836x392.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/e77c7344117692f6c0b63b37770e8c6d.jpg" alt=""></source></picture><div></div></div></a><figcaption>Image 2: An Example tx attack</figcaption></figure></div><h1>Why?</h1><p><strong>Curve Pools</strong> are developed using the Vyper programming language, and this vulnerability exists within the Vyper compiler.</p><p>The vulnerability allows the attacker to perform reentrancy despite the function being protected by the built-in <strong>nonreentrant</strong> decorator in Vyper. </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F8ba2dabf-0e05-4c26-8398-3cb8b2576c06_1600x519.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/ae3f3585f4327b2aedce8e5e85b50083.jpg" alt=""></source></picture><div></div></div></a><figcaption>Image 3: Vulnerability commit</figcaption></figure></div><p>The vulnerability's root cause can be traced back to a commit made between versions 0.2.15 to 0.3.0 of the Vyper compiler, written in Python. During compilation, the Vyper code loads <strong>reentrancy </strong>decorator and stores it into a storage slot. However, the important check to verify if the <strong>reentrancy </strong> already exists before storage and slot increment is missing in the code. Consequently, each function gets its separate reentrancy lock slot, which is independent and fails to provide protection against reentrancy attacks.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0587f2fa-b68b-4664-8c6e-0c533f3471be_1607x203.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/1ad2bd04ada7fba50f832538ce236926.jpg" alt=""></source></picture><div></div></div></a><figcaption>Image 4: Fixed commit</figcaption></figure></div><blockquote><p>Affected Vyper version:</p><ul><li><p><code>0.2.15</code></p></li><li><p><code>0.2.16</code></p></li><li><p><code>0.3.0</code></p></li></ul></blockquote><h1>Conclusion</h1><p>The attacker carefully examined Vyper's bug fixes and targeted contracts using vulnerable versions, resulting in significant losses for Curve.</p><p>The important lesson learned is that vendors must promptly inform the developer community about critical bug fixes. It is encouraged to utilize open-source technologies, including security features developed and reviewed by the community. Conducting thorough security reviews before releasing new versions or making significant changes to essential features is crucial. By adopting these practices, we can enhance system security and provide a safer environment for all users.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

Curve Pools Hack: $59 Million Lost Due to Reentrancy Vulnerabilities in Vyper Versions

什么？ Vyper 是一种编程语言，旨在在区块链平台上创建智能合约。受 Python 启发，Vyper 采用用户友好且易于阅读的语法，使其易于访问...

<div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6bdce2d0-124f-4be9-9ab9-f0c76b6cb5a3_533x128.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6da0dbbd779db4dba51d87c5b0a9c56e.jpg" alt="" title=""></source></picture><div></div></div><figcaption>图 1：Vyper 推文</figcaption></figure></div><h1>什么？</h1><p> <strong>Vyper</strong>是一种编程语言，旨在在区块链平台上创建智能合约。受 Python 启发，Vyper 采用用户友好且易于阅读的语法，适合各个级别的开发人员使用。</p><p> <strong>Curve Pool</strong>是一种去中心化金融 (DeFi) 协议，彻底改变了区块链网络上的稳定币交换。作为专门针对稳定币进行优化的自动做市商 (AMM)，Curve Pool 可确保稳定资产之间的无缝且经济高效的交易，同时将滑点和费用降至最低。其独特的算法旨在最大限度地减少交易过程中的价格影响并最大限度地提高资本效率，使其成为寻求稳定币流动性的交易者和流动性提供者的首选。</p><div><div><div><p>感谢您阅读 Verichains！免费订阅以接收新帖子并支持我的工作。</p></div><div><div></div><div></div></div></div></div><h1>如何？</h1><div><p> <strong>“由于重入锁故障，许多使用 Vyper 0.2.15 的稳定池 (alETH/msETH/pETH) 已被利用。我们正在评估情况，并将随着事态的发展向社区通报最新情况。”</strong> - @CurveFinance</p></div><p>这些攻击发生在多个区块链上，导致总损失超过 5900 万美元。这些损失归因于使用易受攻击的 Vyper 版本并包含ETH的矿池。矿池被黑：</p><ul><li><p> CRV/ ETH池</p></li><li><p>alETH/ ETH池</p></li><li><p>msETH/ ETH池</p></li><li><p>pETH/ ETH池</p></li><li><p>……</p></li></ul><p>据Curve Finance称， Arbitrum上仍有一些矿池可能容易受到攻击。出于预防目的，他们建议用户尽快消除流动性。</p><p>在攻击中，攻击者在调用<strong>remove_liquidity</strong>函数后重新进入<strong>add_liquidity</strong>函数。在重新进入<strong>add_liquidity</strong>函数之前状态没有完全更新，导致<strong>lp_price</strong>计算错误。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F612c059d-8333-4b25-bb08-1aa5029ec4c9_1836x392.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/e77c7344117692f6c0b63b37770e8c6d.jpg" alt=""></source></picture><div></div></div><figcaption>图 2：tx 攻击示例</figcaption></figure></div><h1>为什么？</h1><p> <strong>Curve Pools</strong>是使用Vyper编程语言开发的，该漏洞存在于Vyper编译器中。</p><p>尽管该函数受到 Vyper 中内置的<strong>不可重入</strong>装饰器的保护，但该漏洞仍允许攻击者执行重入。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F8ba2dabf-0e05-4c26-8398-3cb8b2576c06_1600x519.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/ae3f3585f4327b2aedce8e5e85b50083.jpg" alt=""></source></picture><div></div></div><figcaption>图 3：漏洞提交</figcaption></figure></div><p>该漏洞的根本原因可以追溯到用 Python 编写的 Vyper 编译器版本 0.2.15 到 0.3.0 之间的提交。在编译期间，Vyper 代码加载<strong>可重入</strong>装饰器并将其存储到存储槽中。但是，代码中缺少验证在存储和槽增量之前是否已存在<strong>重入性</strong>的重要检查。因此，每个函数都有其单独的重入锁槽，该锁槽是独立的并且无法提供针对重入攻击的保护。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0587f2fa-b68b-4664-8c6e-0c533f3471be_1607x203.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/1ad2bd04ada7fba50f832538ce236926.jpg" alt=""></source></picture><div></div></div><figcaption>图 4：固定提交</figcaption></figure></div><blockquote><p>受影响的Vyper版本：</p><ul><li><p> <code>0.2.15</code></p></li><li><p> <code>0.2.16</code></p></li><li><p> <code>0.3.0</code></p></li></ul></blockquote><h1>结论</h1><p>攻击者仔细检查了 Vyper 的错误修复和使用易受攻击版本的目标合约，导致 Curve 遭受重大损失。</p><p>吸取的重要教训是，供应商必须及时向开发人员社区通报关键错误修复。鼓励使用开源技术，包括社区开发和审查的安全功能。在发布新版本或对基本功能进行重大更改之前进行彻底的安全审查至关重要。通过采用这些做法，我们可以增强系统安全性并为所有用户提供更安全的环境。</p><div><div><div><p>感谢您阅读 Verichains！免费订阅以接收新帖子并支持我的工作。</p></div><div><div></div><div></div></div></div></div>

Curve Pools 黑客攻击：Vyper 版本中的重入漏洞导致 5900 万美元损失

12月18日，在总理主持召开的重要会议上，越南区块链协会主席潘德忠先生就越南区块链网络（Viet...）的实施情况作了直接报告。

VNeID开始集成区块链技术。

原创 | Odaily 星球日报（@OdailyChina）
作者 | Asher（@Asher_ 0210）
12 月 17 日，预测市场平台 predict.fun 的创始人 dingaling 在 X 平台发文宣布，平台已正式开放，并向 BNB Chain 上的 Meme 交易者、Aster 参与者、及各预测市场活跃的用户空投了初始积分。
与 Polymarket、Kalshi 等传统预测市...

手把手带你参与获CZ支持的predict.fun

日本央行官方将基准利率上调至 30 年来的最高水平，标记世界第三大经济体的货币政策迎来了一个重要的转折点。