Ethereum

<div class="sg-post-des">
 A vulnerability in the Vyper programming language widely used by DeFi protocols like Curve Finance led to exploit of multiple Curve liquidity pools on Sunday. 
</div> 
<div class="cointelegraph"> 
 Several Curve Finance liquidity pools were attacked on July 30 due to a vulnerability found in the programming language Vyper.&nbsp;Vyper is a contract programming language created for the Ethereum Virtual Machine (EVM).&nbsp;&nbsp; 
 Curve Finance is one of the key decentralized finance (DeFi) protocol due to the key liquidity services it offers, thus the code <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> has put nearly $100 million worth of digital assets at risk. 
 The <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> was found in the version 0.2.15, 0.2.16 and 0.3.0 leading to a malfunctioning reentrancy lock. As a result, millions were drained from four Curve pools namely aETH/ETH, msETH/ETH, pETH/ETH and CRV/ETH.&nbsp;The flaw in three of its variants may have an effect on a number of other protocols. 
 <blockquote class="twitter-tweet"> 
 Please note that this reentrancy issue is associated with the use of 'use_eth', which could potentially place the WETH-related pools in jeopardy! @CurveFinance , please DM us if you need any help. https://t.co/vjc1RRce7w pic.twitter.com/Wz8DXJZK7Y— BlockSec (@BlockSecTeam) July 30, 2023 
 </blockquote> 
 The <a rel="noopener noreferrer nofollow" title="price" href="https://thebittimes.com/tag/price.html">price</a> of the native token of Curve Finance (CRV) collapsed on the DeFi market due to the significant draining of several of its pools, however, it was eventually saved by the centralized exchange <a rel="noopener noreferrer nofollow" title="price" href="https://thebittimes.com/tag/price.html">price</a> feed. CRV <a rel="noopener noreferrer nofollow" title="price" href="https://thebittimes.com/tag/price.html">price</a> hit $0.086 on decentralized exchanges (DEX) but was trading at $0.60 on centralized exchanges (CEX), thus saving the <a rel="noopener noreferrer nofollow" title="price" href="https://thebittimes.com/tag/price.html">price</a> of the native token from <a rel="noopener noreferrer nofollow" title="collapsing" href="https://thebittimes.com/tag/collapsing.html">collapsing</a> to zero. 
 Related: Pro-XRP lawyer claims SEC prioritizes corporate capitalism over investors 
 Curve pools use Chainlink’s oracle system that incorporates several price feeds including centralized exchanges as well. If not for the CEX price feed the Curve Finance would have collapsed. This ironic incident drew the attention of Binance CEO Changpeng Zhao as well who chuckled at the fact that in the end, it was a Cex price feed that saved the DeFi ecosystem. 
 Zho noted that Binane was not impacted by the Vyper <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> as the crypto exchange has updated the code to the latest version and reminded everyone of the importance of code libraries upgradation. 
 <blockquote class="twitter-tweet"> 
 CEX price feed saves DeFi. ‍️ Binance users are not affected. Our team checked on the Vyper Reentrant Vulnerability. We only use version 0.3.7 or above. It's important to stay up-to-date with code libraries, apps and OS. And stay #SAFU https://t.co/0GFv86KP9R— CZ Binance (@cz_binance) July 31, 2023 
 </blockquote> 
 The bug in the earlier versions of the Vyper code is believed to be at least 1.5 years old and the exploiter is believed to have dug *deep* in the release history to find an exploitable issue for a large protocol with many millions at stake. A Vyper program contributor on Twitter suggests the amount of time and resources put into the exploit indicates it might be a state-sponsored attack. 
 Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space. 
 Magazine: Should crypto projects ever negotiate with hackers? Probably 
 <template data-name="subscription_form" data-type="defi_newsletter"></template> 
</div>

Cex price feed prevents Curve price from collapsing amid $100M vulnerability

TheBitTimes

Other articles published on Aug 1, 2023

Aptos (APT) Price Prediction 2024, 2025, 2026-2030

NTT INDYCAR SERIES Event at Portland International Raceway Named the BitNile.com Grand Prix of Po...

Shibarium Mainnet: Elon Musk’s Mystery Connection Revealed

Crypto Biz: Elon Musk’s X targets financial services, PacWest emergency rescue and more

Breaking: US SEC Sues Richard Heart for Selling Unregistered HEX Securities

DeFi: Under 75% of Projects Funded in 2021 Have Delivered a Product

Join our free newsletter for daily crypto updates!