博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析FEG Bridge Exploit Technical AnalysisOn December 29, 2024 at 5:00 AM UTC, the FEG token bridge system was exploited, which permitted the attacker to withdraw FEG tokens from the bridge contract without depositing them in the source chain. The total profit for the attacker across three blockchains (Ethereum, Base, and BSC) is approximately $1 million USD.
安全事件分析Clober Dex Incident AnalysisOn 10 December 2024, Clober DEX liquidity vault on Base Network was exploited resulting in a loss of 133.7 ETH (~$501k). The root cause of the attack was a reentrancy vulnerability in the _burn() function of the Rebalancer contract. Clober made an announcement via their X account, offering a 20% bounty to the attacker.
安全事件分析Polter Finance Incident AnalysisOn 16 November 2024, Polter Finance was exploited for ~$8.7 million, due to a price manipulation exploit. Polter Finance paused their platform shortly after to investigate. 
安全事件分析DeltaPrime Incident AnalysisOn 11 November 2024, DeltaPrime was exploited for ~$4.8M across Arbitrum and Avalanche network. The attack combined two vulnerabilities. The first one is an unchecked input allowing the attacker to move borrowed token to another arbitrary address.
The second one also involves arbitrary address input that can be exploited by leveraging the claim mechanism to withdraw the collateral.
安全事件分析CryptoBottle Incident AnalysisIn October 2024, CryptoBottle on Polygon was exploited on three separate occasions with combined losses totalling ~$527k. In the latest incident on 24 October, the largest of the three, an attacker exploited a critical vulnerability to disable a balance check in the swap() method after callback, and made arbitrary swaps to acquire a large amount of NAS tokens which they then sold to drain the project of ~$490k USDT.
安全事件分析Omnipus Incident AnalysisOn 11 September 2024, Omnipus contracts were drained of ~$30k received during the presale of the OPUS token.
安全事件分析CUT Token Incident AnalysisOn 10th September, 2024, Caterpillar Coin ($CUT token) suffered a flashloan attack resulting in a loss of ~$1.4M and causing a 99% slippage on the token. The attack exploited vulnerabilities in the ‘price protection mechanisms’, which led to the manipulation of token reserves and rewards.
安全事件分析Vow Incident AnalysisOn 12 August 2024, VOW token was exploited for around $1.2 million. The usdRateSetter address (0xbA1be907f532Ff6bb0088279e0f3DCDdD693aC7c) in the VOW contract temporarily changed the exchange rate (usdRate) between VOW and vUSD from 1 to 100. A malicious actor exploited the new usdRate to obtain vUSD at 100 times the correct amount. 
安全事件分析UtopiaSphere Incident AnalysisOn 21 July 2024, UtopiaSphere token UPS was exploited for ~$521K via a flash loan exploit. The exploiter used flash loaned funds in order to manipulate the token price of UPS by taking advantage of the project’s swapBurn() mechanism which burns a portion of UPS when selling. The UPS/USDT pair has remained empty and inactive since the exploit.
安全事件分析Dough Finance Incident AnalysisOn 12 July 2024, Dough Finance was exploited for ~$2.1m via multiple flash loan transactions. The attacker exploited arbitrary call vulnerabilities in the Dough ConnectorDeleverageParaswap contracts which allowed them to transfer WETH directly from these vulnerable contracts.
安全事件分析YOLO Games（Bazaar）事件分析On 10 June 2024, YOLO Games announced via their X account that a security vulnerability had been reported on the Bazaar LBP contract. As a consequence the YOLO LBP sale was ended early and users holding rYOLO would be refunded. 
安全事件分析The Memecoin Markets of SpringfieldA serial rug puller on Solana executed 64 exit scams in under 24 hours, but lost money on more than 95% of them. We analyze their operation through a Simpsons lens.