博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Oracle Dependency: Decrypting the Sturdy Finance AttackOn Jan 12, 2023, the lending platform Sturdy Finance was attacked, leading to a loss of 442 ETH. The attacker made use of a read-only reentrancy vector to manipulate the price used in a lending protocol to drain funds.- 安全事件分析Initialization Oversight: The Merlin DEX ExploitOn April 26, 2023, Merlin DEX pools were drained due to a vulnerability in the initialization of the MerlinSwapPair contract, leading to a loss of 435 WETH and 811K USDC.
- 安全事件分析BGP Hijacking: The $1.9M KLAYswap Attack Through Manipulated Network FlowOn Feb 3, 2022, KLAYswap was attacked, leading to a loss of $1.9M. The attackers manipulated the network flow and configured it in such a way that the users who were connected to KLAYswap could download malicious code from the server.
- 安全事件分析Curve Conundrum: The dForce Attack via a Read-Only Reentrancy Vector ExploitOn Feb 9, 2023, dForce's lending protocol was attacked, leading to a loss of $3.7M. The attacker made use of a read-only reentrancy vector to manipulate the price in the lending protocol to drain funds from the pool.
- 安全事件分析Aping Peril: The Price Manipulation Exploit with ParaSpaceOn March 17, 2023, a vulnerability located in the AutoCompoundApe contract of the ParaSpace protocol was exploited by a price manipulation attack.
- 安全事件分析Inflated Books: The $250K Attack on Sperax USDOn Feb 4, 2023, SperaxUSD was attacked, leading to a loss of $250K due to the incorrect logic in its Migration/Rebasing Mechanism.
- 安全事件分析Post Mortem: TerraPort FinanceOn April 10th, 2023, the Terraport project team was alarmed breach detected with the Terraport Liquidity wallet. The total loss is around $4M.
- 安全事件分析Earnings Misconfigured: Yearn.finance Exploit ExplainedOn April 13, 2023, yearn.finance was attacked due to a misconfiguration of the yUSDT contract, leading to a loss of approximately $10M.
- 安全事件分析Post Mortem: SushiswapOn April 9th, 2023, the RouteProcessor2 in Sushiswap was exploited due to missing validation on the input with processRoute function. The total loss is around $ 3.3 M.
- 安全事件分析Hunting Orion: The $3M Loss from a Reentrancy AttackOn Feb 2, 2023, the Orion Protocol was exploited for $3M due to a reentrancy attack targeting the exchange contract.
- 安全事件分析MasterChef Mischief: Examining the Rug Pull in Swaprum ProtocolOn May 18, 2023, the Swaprum protocol deployer rug pulled by upgrading the contract “MasterChef” contract to the malicious version and withdrew a significant quantity of LP tokens that staked inside the contract and mint a large amount of Swaprum token to drain the pool.
- 安全事件分析Post Mortem: Thoreum FinanceOn Jan 18, 2023, Thoreum Finance's token contract v4 was exploited, leading to a loss of around 2,260 WBNB. The attacker took advantage of the flawed implementation in the token contract's transfer function and manipulated its balance.