Last week, the DeFi market was exploited for over $200,000. The Biswap DEX hack alone accounted for more than half of the amount, totaling $110,000. This exploit was made possible by the lack of input...

<p>Last week, the DeFi market was exploited for over $200,000. The Biswap DEX hack alone accounted for more than half of the amount, totaling $110,000. This exploit was made possible by the lack of input validation.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F2f0421f9-db13-4ef9-9310-b0a621871679_944x679.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/0aa7877c7aede9e705b6243d36aada71.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><hr></div><h2>Last Week’s Incidents</h2><p>🚨<strong>Project:</strong> Biswap <br>⛓️<strong>Chain:</strong> BSC <br>💥<strong>Type:</strong> Lack of Input Validation <br>💸<strong>Loss amount:</strong> ~$110,000</p><p>Biswap, a decentralized exchange was hacked for over ~$110,000 due to a vulnerability in the <code>V3Migrator</code> contract's <code>migrate</code> method. Attackers were able to exploit this vulnerability and steal tokens from users who had approved their LP tokens for the contract. The vulnerability was related to the lack of verification in the <code>transferFrom</code> method's parameters, allowing unauthorized transfers and resulting in the attackers obtaining the tokens fraudulently.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F4ecef613-01b6-44b5-9f20-eef82387d02e_906x425.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6c61cb2f3cb9e042b6ef1099d6f371d8.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>At the time of writing, Biswap had acknowledged and took full responsibility for the consequences of the incident and is recouping the losses for its users.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F5ac05f59-9f5d-408f-a847-bfefdd78712f_1192x1648.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/3abdd2dc23c5ae04089a3a533846b7a3.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><hr></div><p>🚨<strong>Project:</strong> MyAI <br>⛓️<strong>Chain:</strong> BSC <br>💥<strong>Type:</strong> Lack of Input Validation <br>💸<strong>Loss amount:</strong> $2,500</p><p>A DeFi project called MyAI was exploited for $2,500 due to a vulnerability in the MultiSender contract of the MyAI project. The contract allowed batch transfers of tokens to multiple addresses, but the verification of the sender's eligibility in the "tokenTransfer" method was incorrect. Exploiting this flaw, an attacker could deposit tokens on behalf of anyone into the contract and transfer all the tokens to their own address, effectively stealing them. Proper authorization checks are crucial to prevent unauthorized transfers in smart contracts.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd732b1a2-9c9d-464f-9d16-690f935a7f09_843x866.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/17d34831305611dbcdb45eae459d7287.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><hr></div><p>🚨<strong>Project:</strong> BambooAI <br>⛓️<strong>Chain:</strong> BSC <br>💥<strong>Type:</strong> Price Manipulation <br>💸<strong>Loss amount:</strong> ~$48,000</p><p>A DeFi project called BambooAI was hacked last week for roughly $48,000. The attack exploited a vulnerability caused by the invocation of the private <code>updatePool</code> function from within the <code>_transfer</code> function. As a consequence, the balance of the token pair involved in the pool was manipulated, resulting in an artificial shift in the token's price. The attacker took advantage of this manipulation to gain an unfair advantage or potentially profit from the price movement.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F2f3612b2-b0e3-4746-8625-be4b2d4b428a_1326x1186.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/2cd3d700540dfbbcd2b66893747bf4d8.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fb0f61e8a-7870-45ff-acac-9c055c4689e0_1122x282.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/40da0ebd38dd78d0893f6f0577725f5e.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>At the time of writing, the team at BambooAI had acknowledged the attack and devised a plan to apprehend the developer responsible for deploying the contract.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F2b4b8f01-a9f4-47dc-98e9-4ca66728303b_590x592.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/4763933255fc5036e69e208cc0ae6f4e.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><hr></div><p>🚨<strong>Project:</strong> Bao Finance <br>⛓️<strong>Chain:</strong> BSC <br>💥<strong>Type:</strong> Donate Inflation Attack &amp; Rounding Error <br>💸<strong>Loss amount:</strong> $48,000</p><p>On July 4, Bao Finance was exploited due to a vulnerability in the baoETH vault and the bdbSTBL contract. They manipulated the exchange rate, borrowed a significant amount of baoETH, depleted the liquidity pool on Balancer, and converted it into wETH. Finally, they exploited a bug in the Compound V2 contracts, enabling them to withdraw their collateral without repaying the loan. In total, they stole around 41.3 baoETH, which was equivalent to approximately 21 ETH after considering the gas expenses.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F2b6c42e2-72ae-4546-b200-312c4466bb41_1812x224.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f997d790c99fef8682dcb1440ce1d82c.jpg" alt=""></source></picture><div></div></div></a></figure></div><div><hr></div>

Verichains Weekly Security Digest | July 2023 Week 2

上週，DeFi 市場被利用的金額超過 20 萬美元。僅 Biswap DEX 黑客事件就佔了一半以上，總計 11 萬美元。這種利用是由於缺乏輸入而成為可能的......

<p>上週，DeFi 市場被利用的金額超過 20 萬美元。僅 Biswap DEX 黑客事件就佔了一半以上，總計 11 萬美元。這種利用是由於缺乏輸入驗證而成為可能的。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/0aa7877c7aede9e705b6243d36aada71.jpg" alt=""></source></picture><div></div></div></figure></div><div><hr></div><h2>上週的事件</h2><p>🚨<strong>項目：</strong> Biswap<br> ⛓️<strong>鏈：</strong> BSC<br> 💥<strong>類型：</strong>缺乏輸入驗證<br>💸<strong>損失金額：</strong> ~110,000 美元</p><p>由於<code>V3Migrator</code>合約<code>migrate</code>方法中的漏洞，去中心化交易所 Biswap 遭到黑客攻擊，損失超過 110,000 美元。攻擊者能夠利用此漏洞並從已批准其 LP 代幣用於合約的用戶那裡竊取代幣。該漏洞與<code>transferFrom</code>方法的參數缺乏驗證有關，允許未經授權的轉賬，導致攻擊者欺詐性地獲取代幣。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/6c61cb2f3cb9e042b6ef1099d6f371d8.jpg" alt=""></source></picture><div></div></div></figure></div><p>截至發稿時，Biswap 已承認並對此次事件的後果承擔全部責任，並正在為用戶挽回損失。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/3abdd2dc23c5ae04089a3a533846b7a3.jpg" alt=""></source></picture><div></div></div></figure></div><div><hr></div><p> 🚨<strong>項目：</strong> MyAI<br> ⛓️<strong>鏈：</strong> BSC<br> 💥<strong>類型：</strong>缺乏輸入驗證<br>💸<strong>損失金額：</strong> $2,500</p><p>由於 MyAI 項目的 MultiSender 合約存在漏洞，一個名為 MyAI 的 DeFi 項目被利用了 2500 美元。該合約允許將代幣批量轉移到多個地址，但“tokenTransfer”方法中對發送者資格的驗證不正確。利用此缺陷，攻擊者可以代表任何人將代幣存入合約中，並將所有代幣轉移到他們自己的地址，從而有效地竊取它們。適當的授權檢查對於防止智能合約中未經授權的轉移至關重要。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/17d34831305611dbcdb45eae459d7287.jpg" alt=""></source></picture><div></div></div></figure></div><div><hr></div><p> 🚨<strong>項目：</strong> BambooAI<br> ⛓️<strong>鏈：</strong> BSC<br> 💥<strong>類型：</strong>價格操縱<br>💸<strong>損失金額：</strong> ~$48,000</p><p>上週，一個名為 BambooAI 的 DeFi 項目遭到黑客攻擊，損失約為 48,000 美元。該攻擊利用了從<code>_transfer</code>函數內調用私有<code>updatePool</code>函數引起的漏洞。結果，池中涉及的代幣對的餘額被操縱，導致代幣價格人為變化。攻擊者利用這種操縱來獲得不公平的優勢或從價格變動中潛在獲利。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/2cd3d700540dfbbcd2b66893747bf4d8.jpg" alt=""></source></picture><div></div></div></figure></div><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/40da0ebd38dd78d0893f6f0577725f5e.jpg" alt=""></source></picture><div></div></div></figure></div><p>截至撰寫本文時，BambooAI 團隊已承認此次攻擊，並製定了一項計劃來逮捕負責部署該合約的開發人員。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/4763933255fc5036e69e208cc0ae6f4e.jpg" alt=""></source></picture><div></div></div></figure></div><div><hr></div><p> 🚨<strong>項目：</strong>寶金融<br>⛓️<strong>鏈：</strong> BSC<br> 💥<strong>類型：</strong>捐贈通貨膨脹攻擊和舍入誤差<br>💸<strong>損失金額：</strong> $48,000</p><p> 7月4日，Bao Finance因baoETH金庫和bdbSTBL合約存在漏洞而被利用。他們操縱匯率，借入大量的baoETH，耗盡Balancer上的流動性池，並將其轉換為wETH。最後，他們利用了Compound V2合約中的一個錯誤，使他們能夠在不償還貸款的情況下提取抵押品。他們總共竊取了約 41.3 baoETH，考慮到 Gas 費用後，相當於約 21 ETH 。 </p><div><figure><div><picture><source><img src="https://static.fwimg.io/img/feed/f997d790c99fef8682dcb1440ce1d82c.jpg" alt=""></source></picture><div></div></div></figure></div><div><hr></div>

Verichains 每週安全文摘 | 2023 年 7 月 第 2 周

來源：Galaxy Research；翻譯：金色財經xz
比特幣2025年的收官價位預計將與年初水平大體持平。
今年前十個月，加密貨幣市場經歷了一輪真正的看漲浪潮。監管改革持續推進，ETF持續吸納資金，鏈上活動也日趨活躍。比特幣在10月6日創下126,080美元的歷史新高。
然而，市場在狂熱情緒後並未迎來期待的突破，取而代之的是輪動、重定價和再平衡。宏觀預期的落空、投資敘事的轉向、槓桿的爆倉以及巨...

Galaxy：2026年加密市場26大預測

Tom Lee 大力對比特幣、以太坊喊多，但他背靠的華爾街金融策略基金 Fundstrat 卻給出差異相當大的 […]
〈CryptoQuant：Tom Lee 大力喊多頭！卻被自家基金 Fundstrat 打臉原因是「賣方研究立場」〉這篇文章最早發佈於動區BlockTempo《動區動趨-最具影響力的區塊鏈新聞媒體》。

CryptoQuant：Tom Lee 大力喊多頭！卻被自家基金 Fundstrat 打臉原因是「賣方研究立場」

今年對於注重隱私的加密貨幣而言是碩果累累的一年，延續了以往牛市的Optimism。其中最引人注目的是Zcash基金會推出的一系列重大更新……

Verichains 每週安全文摘 | 2023 年 7 月 第 2 周

上週的事件

Verichains 每週安全文摘 | 2023 年 7 月第 2 周