博客
研究报告
深入的安全报告、事件分析和行业研究，涵盖 Web3 安全现状。
安全事件分析Post Mortem: FintochOn May 5th, 2023, the Fintoch was rugpulled, leading to a loss of ~$31.6M.- 安全事件分析Slippery Rug: The Uncontrolled Launch of SmashcashOn Feb 13, 2023, Smashcash was reported with a potential rug pull implanted within the initial token distribution, where the wallets that received the initial distribution sold the tokens for ~45.6 BNB.
- 安全事件分析unshETH Private Key Slip: $375,000 Loss from a Github PostOn Jun 01, 2023, the staking platform unshETH was attacked, leading to a loss of around $375,000.
- 安全事件分析Lending Rate Manipulation: Investigating the FilDA Finance AttackOn April 22, 2023, FilDA Finance was attacked, leading to a loss of around $700K. The attacker manipulated the exchange rate in the lending pool and drained funds from it.
- 安全事件分析Sneaky Sandwich Exploit: The BabyDoge Attack Caused 442 BNB LossOn Jun 21, 2023, BabyDoge was attacked, leading to a loss of 442 BNB. The attacker made use of a contract that could waive the fee and performed a sandwich attack.
- 安全事件分析Multichain Collapse: The Private Key Leak That Drained $125M+On July 6, 2023, the cross-chain bridge protocol Multichain experienced large unauthorized withdrawals, suggesting a likely Private Key issue.
- 安全事件分析Stablecoin Stumble: The Code Bug Led to $6.5 Million Loss on DeuS FinanceOn May 5th, 2023, the Deus stablecoin was attacked due to issues within its code logic, leading to a loss of $6,500,000.
- 安全事件分析Post Mortem: SafemoonOn Mar 28th, 2023, the Safemoon token contract was attacked, leading to a loss of $8.9M. The attacker took advantage of the public burn function and drained funds from the LP pool.
- 安全事件分析Post Mortem: TelcoinOn Dec 26th, 2023, Telcoin experienced a loss of ~$1.25M attack. The vulnerable contract is due to a vulnerability in the proxy implementation of wallet contracts, which is a different application from what CertiK has audited.
- 安全事件分析Post Mortem: Onyx ProtocolOn Nov 1, 2023, Onyx Protocol was attacked, leading to a loss of around $2.1M. The Onyx team added a new PEPE market without any initial funds, so the hacker was able to manipulate the exchange rate of the PEPE market and borrow assets from other Onyx markets, also got back all the collateral due to rounding errors in solidity, causing bad debts in these markets.
This vulnerability was identified in CertiK's audit report, and CertiK recommended that the project team add a new contract capable of minting fresh shares when the contract is deployed. The Onyx team acknowledged this issue and decided not to perform any action on the contract.
- 安全事件分析Post Mortem: HashflowOn June 14th, 2023, Hashflow experienced a loss of ~$605k across five chains. The vulnerable contract is unverified and the vulnerable `0x1ce5` function contains a `transferFrom` function the attacker could trigger to steal user funds when approved. The vulnerable function was absent from the audited codebase, it is out of the audit scope.
- 安全事件分析Post Mortem: BiSwapOn June 30th, 2023, the liquidity migrator contract of Biswap, for migrating liquidity from v2 to v3, was exploited. The vulnerable code is located on the `MigratorV3` contract, which is not audited by Certik.