What? Vyper is a programming language designed for creating smart contracts on blockchain platforms. Inspired by Python, Vyper adopts a user-friendly and easily readable syntax, making it accessible t...

<div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6bdce2d0-124f-4be9-9ab9-f0c76b6cb5a3_533x128.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6da0dbbd779db4dba51d87c5b0a9c56e.jpg" alt="" title=""></source></picture><div></div></div></a><figcaption>Image 1: Vyper tweet</figcaption></figure></div><h1>What?</h1><p><strong>Vyper</strong> is a programming language designed for creating smart contracts on blockchain platforms. Inspired by Python, Vyper adopts a user-friendly and easily readable syntax, making it accessible to developers of all levels.</p><p><strong>Curve Pool</strong> is a decentralized finance (DeFi) protocol that revolutionizes stablecoin swapping on blockchain networks. As an automated market maker (AMM) optimized exclusively for stablecoins, Curve Pool ensures seamless and cost-effective exchanges between stable assets with minimal slippage and fees. Its unique algorithm is designed to minimize price impact during trades and maximize capital efficiency, making it a preferred choice for traders and liquidity providers seeking stablecoin liquidity.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div><h1>How?</h1><div><p><strong>“A number of stablepools (alETH/msETH/pETH) using Vyper 0.2.15 have been exploited as a result of a malfunctioning reentrancy lock. We are assessing the situation and will update the community as things develop.”</strong> - @CurveFinance</p></div><p>The attacks have occurred across various blockchain chains, resulting in a total loss of over $59 million. These losses are attributed to pools that use vulnerable versions of Vyper and contain ETH. Pools Hacked:</p><ul><li><p>CRV/ETH pool</p></li><li><p>alETH/ETH pool</p></li><li><p>msETH/ETH pool</p></li><li><p>pETH/ETH pool</p></li><li><p>…</p></li></ul><p>According to Curve Finance, there are still pools on Arbitrum that may be vulnerable. They advise users to remove liquidity as soon as possible for precautionary reasons.</p><p>In attacks, the attacker reentered the <strong>add_liquidity</strong> function after calling the <strong>remove_liquidity</strong> function. The states do not fully update before reentering the <strong>add_liquidity</strong> function, resulting in <strong>lp_price</strong> calculation error.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F612c059d-8333-4b25-bb08-1aa5029ec4c9_1836x392.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/e77c7344117692f6c0b63b37770e8c6d.jpg" alt=""></source></picture><div></div></div></a><figcaption>Image 2: An Example tx attack</figcaption></figure></div><h1>Why?</h1><p><strong>Curve Pools</strong> are developed using the Vyper programming language, and this vulnerability exists within the Vyper compiler.</p><p>The vulnerability allows the attacker to perform reentrancy despite the function being protected by the built-in <strong>nonreentrant</strong> decorator in Vyper. </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F8ba2dabf-0e05-4c26-8398-3cb8b2576c06_1600x519.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/ae3f3585f4327b2aedce8e5e85b50083.jpg" alt=""></source></picture><div></div></div></a><figcaption>Image 3: Vulnerability commit</figcaption></figure></div><p>The vulnerability's root cause can be traced back to a commit made between versions 0.2.15 to 0.3.0 of the Vyper compiler, written in Python. During compilation, the Vyper code loads <strong>reentrancy </strong>decorator and stores it into a storage slot. However, the important check to verify if the <strong>reentrancy </strong> already exists before storage and slot increment is missing in the code. Consequently, each function gets its separate reentrancy lock slot, which is independent and fails to provide protection against reentrancy attacks.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0587f2fa-b68b-4664-8c6e-0c533f3471be_1607x203.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/1ad2bd04ada7fba50f832538ce236926.jpg" alt=""></source></picture><div></div></div></a><figcaption>Image 4: Fixed commit</figcaption></figure></div><blockquote><p>Affected Vyper version:</p><ul><li><p><code>0.2.15</code></p></li><li><p><code>0.2.16</code></p></li><li><p><code>0.3.0</code></p></li></ul></blockquote><h1>Conclusion</h1><p>The attacker carefully examined Vyper's bug fixes and targeted contracts using vulnerable versions, resulting in significant losses for Curve.</p><p>The important lesson learned is that vendors must promptly inform the developer community about critical bug fixes. It is encouraged to utilize open-source technologies, including security features developed and reviewed by the community. Conducting thorough security reviews before releasing new versions or making significant changes to essential features is crucial. By adopting these practices, we can enhance system security and provide a safer environment for all users.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

Curve Pools Hack: $59 Million Lost Due to Reentrancy Vulnerabilities in Vyper Versions

什麼？ Vyper 是一種程式語言，旨在在區塊鏈平臺上建立智慧合約。受 Python 啟發，Vyper 採用使用者友好且易於閱讀的語法，使其易於訪問...

<div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F6bdce2d0-124f-4be9-9ab9-f0c76b6cb5a3_533x128.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/6da0dbbd779db4dba51d87c5b0a9c56e.jpg" alt="" title=""></source></picture><div></div></div><figcaption>圖 1：Vyper 推文</figcaption></figure></div><h1>什麼？</h1><p> <strong>Vyper</strong>是一種程式語言，旨在在區塊鏈平臺上建立智慧合約。受 Python 啟發，Vyper 採用使用者友好且易於閱讀的語法，適合各個級別的開發人員使用。</p><p> <strong>Curve Pool</strong>是一種去中心化金融 (DeFi) 協議，徹底改變了區塊鏈網路上的穩定幣交換。作為專門針對穩定幣進行優化的自動做市商 (AMM)，Curve Pool 可確保穩定資產之間的無縫且經濟高效的交易，同時將滑點和費用降至最低。其獨特的演算法旨在最大限度地減少交易過程中的價格影響並最大限度地提高資本效率，使其成為尋求穩定幣流動性的交易者和流動性提供者的首選。</p><div><div><div><p>感謝您閱讀 Verichains！免費訂閱以接收新帖子並支援我的工作。</p></div><div><div></div><div></div></div></div></div><h1>如何？</h1><div><p> <strong>“由於重入鎖故障，許多使用 Vyper 0.2.15 的穩定池 (alETH/msETH/pETH) 已被利用。我們正在評估情況，並將隨著事態的發展向社群通報最新情況。”</strong> - @CurveFinance</p></div><p>這些攻擊發生在多個區塊鏈上，導致總損失超過 5900 萬美元。這些損失歸因於使用易受攻擊的 Vyper 版本幷包含ETH的礦池。礦池被黑：</p><ul><li><p> CRV/ ETH池</p></li><li><p>alETH/ ETH池</p></li><li><p>msETH/ ETH池</p></li><li><p>pETH/ ETH池</p></li><li><p>……</p></li></ul><p>據Curve Finance稱， Arbitrum上仍有一些礦池可能容易受到攻擊。出於預防目的，他們建議使用者儘快消除流動性。</p><p>在攻擊中，攻擊者在呼叫<strong>remove_liquidity</strong>函式後重新進入<strong>add_liquidity</strong>函式。在重新進入<strong>add_liquidity</strong>函式之前狀態沒有完全更新，導致<strong>lp_price</strong>計算錯誤。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F612c059d-8333-4b25-bb08-1aa5029ec4c9_1836x392.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/e77c7344117692f6c0b63b37770e8c6d.jpg" alt=""></source></picture><div></div></div><figcaption>圖 2：tx 攻擊示例</figcaption></figure></div><h1>為什麼？</h1><p> <strong>Curve Pools</strong>是使用Vyper程式語言開發的，該漏洞存在於Vyper編譯器中。</p><p>儘管該函式受到 Vyper 中內建的<strong>不可重入</strong>裝飾器的保護，但該漏洞仍允許攻擊者執行重入。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F8ba2dabf-0e05-4c26-8398-3cb8b2576c06_1600x519.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/ae3f3585f4327b2aedce8e5e85b50083.jpg" alt=""></source></picture><div></div></div><figcaption>圖 3：漏洞提交</figcaption></figure></div><p>該漏洞的根本原因可以追溯到用 Python 編寫的 Vyper 編譯器版本 0.2.15 到 0.3.0 之間的提交。在編譯期間，Vyper 程式碼載入<strong>可重入</strong>裝飾器並將其儲存到儲存槽中。但是，程式碼中缺少驗證在儲存和槽增量之前是否已存在<strong>重入性</strong>的重要檢查。因此，每個函式都有其單獨的重入鎖槽，該鎖槽是獨立的並且無法提供針對重入攻擊的保護。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F0587f2fa-b68b-4664-8c6e-0c533f3471be_1607x203.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/1ad2bd04ada7fba50f832538ce236926.jpg" alt=""></source></picture><div></div></div><figcaption>圖 4：固定提交</figcaption></figure></div><blockquote><p>受影響的Vyper版本：</p><ul><li><p> <code>0.2.15</code></p></li><li><p> <code>0.2.16</code></p></li><li><p> <code>0.3.0</code></p></li></ul></blockquote><h1>結論</h1><p>攻擊者仔細檢查了 Vyper 的錯誤修復和使用易受攻擊版本的目標合約，導致 Curve 遭受重大損失。</p><p>吸取的重要教訓是，供應商必須及時向開發人員社群通報關鍵錯誤修復。鼓勵使用開源技術，包括社群開發和審查的安全功能。在釋出新版本或對基本功能進行重大更改之前進行徹底的安全審查至關重要。通過採用這些做法，我們可以增強系統安全性併為所有使用者提供更安全的環境。</p><div><div><div><p>感謝您閱讀 Verichains！免費訂閱以接收新帖子並支援我的工作。</p></div><div><div></div><div></div></div></div></div>

Curve Pools 黑客攻擊：Vyper 版本中的重入漏洞導致 5900 萬美元損失

12月18日，在總理主持召開的重要會議上，越南區塊鏈協會主席潘德忠先生就越南區塊鏈網絡（Viet...）的實施情況作了直接報告。

VNeID開始集成區塊鏈技術。

日本央行官方將基準利率上調至 30 年來的最高水平，標記世界第三大經濟體的貨幣政策迎來了一個重要的轉折點。

日本繼續上漲利率，達到30年來的最高水平。

原創 | Odaily 星球日報（@OdailyChina）
作者 | Asher（@Asher_ 0210）
12 月 17 日，預測市場平臺 predict.fun 的創始人 dingaling 在 X 平臺發文宣佈，平臺已正式開放，並向 BNB Chain 上的 Meme 交易者、Aster 參與者、及各預測市場活躍的用戶空投了初始積分。
與 Polymarket、Kalshi 等傳統預測市...