The sdrETH contract of the SumerMoney project, a forked version of the CEther contract from Compound, was recently attacked. The attack vector is not new; the attacker leveraged a reentrancy vulnerability to manipulate the exchange rate between the wrapped

<p>The <code>sdrETH</code> contract of the SumerMoney project, a forked version of the <code>CEther</code> contract from Compound, was recently attacked. The attack vector is not new; the attacker leveraged a reentrancy vulnerability to manipulate the exchange rate between the wrapped <code>sdrToken</code> and the underlying token.</p><h3>Overview</h3><p>Attacker address:</p><p><a href="https://basescan.org/address/0xbb344544ad328b5492397e967fe81737855e7e77" rel="nofollow">https://basescan.org/address/0xbb344544ad328b5492397e967fe81737855e7e77</a></p><p>Attack transaction: <a href="https://basescan.org/tx/0x619c44af9fedb8f5feea2dcae1da94b6d7e5e0e7f4f4a99352b6c4f5e43a4661" rel="nofollow">https://basescan.org/tx/0x619c44af9fedb8f5feea2dcae1da94b6d7e5e0e7f4f4a99352b6c4f5e43a4661</a></p><p>Vulnerable contract (<code>sdrETH</code> token): <a href="https://basescan.org/address/0x7b5969bb51fa3b002579d7ee41a454ac691716dc" rel="nofollow">https://basescan.org/address/0x7b5969bb51fa3b002579d7ee41a454ac691716dc</a></p><h3>Exploit analysis</h3><p>The attacker first performed a flash loan to borrow a large amount of 150 WETH and 645,000 USDC from the Balancer Vault. Then, he attempted to push these assets into the <code>sdrETH</code> and <code>sdrUSDC</code> contracts to mint the corresponding wrapped tokens.</p><p>With these assets as collateral, the attacker attempted to borrow all the available underlying assets in the <code>sdrETH</code> market, which amounted to approximately 150 ETH. After borrowing, the attacker immediately called the <code>repayBorrowBehalf</code> function, repaying the borrowed ETH plus "<em>1 wei</em>". Since the <code>repayBorrowBehalf</code> function refunds the excess amount to the payer using the low-level <code>address.call</code> method, it eventually triggers the reentrancy attack flow. Leveraging this vulnerability, the attacker can manipulate the exchange rate in their fallback function before the <code>totalBorrows</code> is updated.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fc0882ac2-d9f0-4030-ac50-fe0b4a561601_1514x608.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/00942eefada076fe7c9e8c1b9ad91b2f.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>Check out the Compound documentation regarding the exchange rate, and we can see that if the <code>totalBorrows()</code> isn't correctly decreased after repayment, the exchange rate would be much higher than it should be.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fdf2e98a5-1079-40fb-90eb-9d09fd3b1cb5_1860x474.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5f09fb7664d81cd324f5f232e8489cad.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>The attacker then proceeded to borrow all the remaining assets in the <code>sdrcbETH</code> and <code>sdrUSDC</code> markets.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3ffb96c2-1fcb-4b4e-8a62-5c25afe6dbb6_2298x1096.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/c968feebea0a8f9d513e0e605c164a37.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>With the manipulated exchange rate of the <code>sdrETH</code> market, the attacker only needed approximately 74 <code>sdrETH</code> to redeem back his original amount of 150 ETH, while the <code>sdrUSDC</code> amount was redeemed as normal.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fe04547d9-a04e-4db2-bca7-86568099bc16_2390x1142.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6541dd86a0e505efe8fd75c296d3524a.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>After repaying all the loans and completing the attack, the attacker profited approximately 10 cbETH and 310,000 USDC.</p><h3>Conclusion</h3><p>Web3 developers should exercise caution when customizing common protocols such as Compound, especially when introducing new features or modifying existing ones.</p><p>Although the reentrancy attack is a well-known vulnerability in smart contracts and has been exploited in many previous projects, it remains a common attack vector in the Web3 space. This attack highlights the importance of security audits and the necessity for developers to adhere to best practices in future projects.</p>

Sumer Money hack - Reentrancy and exchange rate manipulation

SumerMoney 项目的 sdrETH 合约（Compound 的 CEther 合约的分叉版本）最近遭到攻击。攻击媒介并不新鲜；攻击者利用重入漏洞操纵包装的

<p>SumerMoney 专案的<code>sdrETH</code>合约是Compound 的<code>CEther</code>合约的分叉版本，最近遭到攻击。这种攻击方式并不新鲜；攻击者利用重入漏洞来操纵包装的<code>sdrToken</code>和底层代币之间的汇率。</p><h3>概述</h3><p>攻击者地址：</p><p> <a href="https://basescan.org/address/0xbb344544ad328b5492397e967fe81737855e7e77" rel="nofollow">https://basescan.org/address/0xbb344544ad328b5492397e967fe81737855e7e77</a></p><p>攻击交易： <a href="https://basescan.org/tx/0x619c44af9fedb8f5feea2dcae1da94b6d7e5e0e7f4f4a99352b6c4f5e43a4661" rel="nofollow">https://basescan.org/tx/0x619c44af9fedb8f5feea2dcae1da94b6d7e5e0e7f4f4a99352b6c4f5e43a4661</a></p><p>易受攻击的合约（ <code>sdrETH</code>代币）： <a href="https://basescan.org/address/0x7b5969bb51fa3b002579d7ee41a454ac691716dc" rel="nofollow">https://basescan.org/address/0x7b5969bb51fa3b002579d7ee41a454ac691716dc</a></p><h3>漏洞利用分析</h3><p>攻击者先进行闪电贷，向 Balancer Vault 借入大量 150 WETH 和 645,000 USDC 。然后，他尝试将这些资产推入<code>sdrETH</code>和<code>sdrUSDC</code>合约中，以铸造相应的包装代币。</p><p>以这些资产作为抵押，攻击者试图借入<code>sdrETH</code>市场上所有可用的基础资产，金额约为 150 ETH。借款后，攻击者立即呼叫<code>repayBorrowBehalf</code>函数，偿还借入的ETH加「 <em>1 wei</em> 」。由于<code>repayBorrowBehalf</code>函数使用低阶的<code>address.call</code>方法将多余的金额退还给付款人，因此最终触发了重入攻击流程。利用此漏洞，攻击者可以在更新<code>totalBorrows</code>之前在后备函数中操纵汇率。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fc0882ac2-d9f0-4030-ac50-fe0b4a561601_1514x608.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/00942eefada076fe7c9e8c1b9ad91b2f.jpg" alt=""></source></picture><div></div></div></figure></div><p>查看Compound文件中有关汇率的内容，我们可以看到，如果还款后<code>totalBorrows()</code>没有正确减少，汇率会比应有的高得多。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fdf2e98a5-1079-40fb-90eb-9d09fd3b1cb5_1860x474.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5f09fb7664d81cd324f5f232e8489cad.jpg" alt=""></source></picture><div></div></div></figure></div><p>然后，攻击者继续借入<code>sdrcbETH</code>和<code>sdrUSDC</code>市场上的所有剩余资产。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3ffb96c2-1fcb-4b4e-8a62-5c25afe6dbb6_2298x1096.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/c968feebea0a8f9d513e0e605c164a37.jpg" alt=""></source></picture><div></div></div></figure></div><p>在<code>sdrETH</code>市场汇率被操纵的情况下，攻击者只需要大约74个<code>sdrETH</code>就可以赎回自己原来的150个ETH，而<code>sdrUSDC</code>则正常赎回。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fe04547d9-a04e-4db2-bca7-86568099bc16_2390x1142.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6541dd86a0e505efe8fd75c296d3524a.jpg" alt=""></source></picture><div></div></div></figure></div><p>偿还所有贷款并完成攻击后，攻击者获利约 10 cbETH 和 310,000 USDC。</p><h3>结论</h3><p>Web3 开发人员在自订诸如Compound 之类的通用协定时应谨慎行事，尤其是在引入新功能或修改现有功能时。</p><p>尽管重入攻击是智慧合约中众所周知的漏洞，并且已在许多先前的专案中被利用，但它仍然是 Web3 领域的常见攻击媒介。这次攻击凸显了安全审计的重要性以及开发人员在未来专案中遵循最佳实务的必要性。</p>

Sumer Money 黑客 - 重入和汇率操纵

Polymarket 上一玩家 1 年交易 61,793 次，狂赚 10.6 万美元。

蚊子肉，滚出 10 万美元利润

[以太坊]
每日行情重点数据回顾和趋势分析，由PANews出品。
1.市场观察
今晚21:30美国劳工统计局将公布1月非农就业报告，并进行年度基准修正。市场预期1月新增就业岗位仅为7万，失业率维持在4.4%。然而，多名经济学家预测数据可能远低于预期，甚至接近零增长，同时年度修正或抹去超百万个就业岗位。市场押注美联储今年或降息两到三次，分析师指出若非农数据低于预期，美元将承压，黄金或迎来反攻契机。道...

交易时刻：非农数据公布在即，比特币挑战6万5支撑位，短期内市场或将维持震荡

身家千亿，出狱后客厅还在漏水。