블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석FEG Bridge Exploit Technical AnalysisOn December 29, 2024 at 5:00 AM UTC, the FEG token bridge system was exploited, which permitted the attacker to withdraw FEG tokens from the bridge contract without depositing them in the source chain. The total profit for the attacker across three blockchains (Ethereum, Base, and BSC) is approximately $1 million USD.
보안 사고 분석Clober Dex Incident AnalysisOn 10 December 2024, Clober DEX liquidity vault on Base Network was exploited resulting in a loss of 133.7 ETH (~$501k). The root cause of the attack was a reentrancy vulnerability in the _burn() function of the Rebalancer contract. Clober made an announcement via their X account, offering a 20% bounty to the attacker.
보안 사고 분석Polter Finance Incident AnalysisOn 16 November 2024, Polter Finance was exploited for ~$8.7 million, due to a price manipulation exploit. Polter Finance paused their platform shortly after to investigate. 
보안 사고 분석DeltaPrime Incident AnalysisOn 11 November 2024, DeltaPrime was exploited for ~$4.8M across Arbitrum and Avalanche network. The attack combined two vulnerabilities. The first one is an unchecked input allowing the attacker to move borrowed token to another arbitrary address.
The second one also involves arbitrary address input that can be exploited by leveraging the claim mechanism to withdraw the collateral.
보안 사고 분석CryptoBottle Incident AnalysisIn October 2024, CryptoBottle on Polygon was exploited on three separate occasions with combined losses totalling ~$527k. In the latest incident on 24 October, the largest of the three, an attacker exploited a critical vulnerability to disable a balance check in the swap() method after callback, and made arbitrary swaps to acquire a large amount of NAS tokens which they then sold to drain the project of ~$490k USDT.
보안 사고 분석Omnipus Incident AnalysisOn 11 September 2024, Omnipus contracts were drained of ~$30k received during the presale of the OPUS token.
보안 사고 분석CUT Token Incident AnalysisOn 10th September, 2024, Caterpillar Coin ($CUT token) suffered a flashloan attack resulting in a loss of ~$1.4M and causing a 99% slippage on the token. The attack exploited vulnerabilities in the ‘price protection mechanisms’, which led to the manipulation of token reserves and rewards.
보안 사고 분석Vow Incident AnalysisOn 12 August 2024, VOW token was exploited for around $1.2 million. The usdRateSetter address (0xbA1be907f532Ff6bb0088279e0f3DCDdD693aC7c) in the VOW contract temporarily changed the exchange rate (usdRate) between VOW and vUSD from 1 to 100. A malicious actor exploited the new usdRate to obtain vUSD at 100 times the correct amount. 
보안 사고 분석UtopiaSphere Incident AnalysisOn 21 July 2024, UtopiaSphere token UPS was exploited for ~$521K via a flash loan exploit. The exploiter used flash loaned funds in order to manipulate the token price of UPS by taking advantage of the project’s swapBurn() mechanism which burns a portion of UPS when selling. The UPS/USDT pair has remained empty and inactive since the exploit.
보안 사고 분석Dough Finance Incident AnalysisOn 12 July 2024, Dough Finance was exploited for ~$2.1m via multiple flash loan transactions. The attacker exploited arbitrary call vulnerabilities in the Dough ConnectorDeleverageParaswap contracts which allowed them to transfer WETH directly from these vulnerable contracts.
보안 사고 분석YOLO Games (Bazaar) 인시던트 분석On 10 June 2024, YOLO Games announced via their X account that a security vulnerability had been reported on the Bazaar LBP contract. As a consequence the YOLO LBP sale was ended early and users holding rYOLO would be refunded. 
보안 사고 분석The Memecoin Markets of SpringfieldA serial rug puller on Solana executed 64 exit scams in under 24 hours, but lost money on more than 95% of them. We analyze their operation through a Simpsons lens.