블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석Post Mortem: FintochOn May 5th, 2023, the Fintoch was rugpulled, leading to a loss of ~$31.6M.- 보안 사고 분석Slippery Rug: The Uncontrolled Launch of SmashcashOn Feb 13, 2023, Smashcash was reported with a potential rug pull implanted within the initial token distribution, where the wallets that received the initial distribution sold the tokens for ~45.6 BNB.
- 보안 사고 분석unshETH Private Key Slip: $375,000 Loss from a Github PostOn Jun 01, 2023, the staking platform unshETH was attacked, leading to a loss of around $375,000.
- 보안 사고 분석Lending Rate Manipulation: Investigating the FilDA Finance AttackOn April 22, 2023, FilDA Finance was attacked, leading to a loss of around $700K. The attacker manipulated the exchange rate in the lending pool and drained funds from it.
- 보안 사고 분석Sneaky Sandwich Exploit: The BabyDoge Attack Caused 442 BNB LossOn Jun 21, 2023, BabyDoge was attacked, leading to a loss of 442 BNB. The attacker made use of a contract that could waive the fee and performed a sandwich attack.
- 보안 사고 분석Multichain Collapse: The Private Key Leak That Drained $125M+On July 6, 2023, the cross-chain bridge protocol Multichain experienced large unauthorized withdrawals, suggesting a likely Private Key issue.
- 보안 사고 분석Stablecoin Stumble: The Code Bug Led to $6.5 Million Loss on DeuS FinanceOn May 5th, 2023, the Deus stablecoin was attacked due to issues within its code logic, leading to a loss of $6,500,000.
- 보안 사고 분석Post Mortem: SafemoonOn Mar 28th, 2023, the Safemoon token contract was attacked, leading to a loss of $8.9M. The attacker took advantage of the public burn function and drained funds from the LP pool.
- 보안 사고 분석Post Mortem: TelcoinOn Dec 26th, 2023, Telcoin experienced a loss of ~$1.25M attack. The vulnerable contract is due to a vulnerability in the proxy implementation of wallet contracts, which is a different application from what CertiK has audited.
- 보안 사고 분석Post Mortem: Onyx ProtocolOn Nov 1, 2023, Onyx Protocol was attacked, leading to a loss of around $2.1M. The Onyx team added a new PEPE market without any initial funds, so the hacker was able to manipulate the exchange rate of the PEPE market and borrow assets from other Onyx markets, also got back all the collateral due to rounding errors in solidity, causing bad debts in these markets.
This vulnerability was identified in CertiK's audit report, and CertiK recommended that the project team add a new contract capable of minting fresh shares when the contract is deployed. The Onyx team acknowledged this issue and decided not to perform any action on the contract.
- 보안 사고 분석Post Mortem: HashflowOn June 14th, 2023, Hashflow experienced a loss of ~$605k across five chains. The vulnerable contract is unverified and the vulnerable `0x1ce5` function contains a `transferFrom` function the attacker could trigger to steal user funds when approved. The vulnerable function was absent from the audited codebase, it is out of the audit scope.
- 보안 사고 분석Post Mortem: BiSwapOn June 30th, 2023, the liquidity migrator contract of Biswap, for migrating liquidity from v2 to v3, was exploited. The vulnerable code is located on the `MigratorV3` contract, which is not audited by Certik.