Ethereum

Ellipsis

<div class="sg-post-des">
  A number of pools using Vyper have been exploited due to a malfunctioning reentrancy lock that potentially exposes all pools with wrapped Ether (WETH). 
</div> 
<div class="cointelegraph"> 
 <p>Decentralized finance (DeFi) protocols are undergoing a <a rel="noopener noreferrer nofollow" title="stress" href="https://thebittimes.com/tag/stress.html">stress</a> test following a critical <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> was found on versions of Vyper programming language, resulting in the theft of millions of dollars' worth of cryptocurrencies on July 30.</p> 
 <p>A number of pools using Vyper 0.2.15, 0.2.16 and 0.3.0 have been exploited due to a malfunctioning reentrancy lock, targeting at least four liquidity pools on Curve Finance protocol. "The short answer is that everything that could be drained was drained. The targeted pools are aETH/ETH, msETH/ETH, pETH/ETH and CRV/ETH. All remaining pools are safe and unaffected by the bug," Curve Finance said on Discord. </p> 
 <p>BlockSec, an auditing firm for smart contracts, noted that the reentrancy could potentially place all pools with wrapped Ether (WETH) at risk of attack.</p> 
 <blockquote class="twitter-tweet"> 
  <p lang="en" dir="ltr">Please note that this reentrancy issue is associated with the use of 'use_eth', which could potentially place the WETH-related pools in jeopardy! @CurveFinance , please DM us if you need any help. https://t.co/vjc1RRce7w pic.twitter.com/Wz8DXJZK7Y</p>— BlockSec (@BlockSecTeam) July 30, 2023 
 </blockquote> 
 <p>Vyper is a contract programming language designed for Ethereum Virtual Machine (EVM). It is considered one of the most widely used Web3 programming languages, which means the bug in three of its versions could have an impact on several other protocols. </p> 
 <p>The attack affects a number of decentralized finance projects, with Alchemix's alETH-ETH reporting outflows of $13.6 million, PEGd’s pETH-ETH pool drained by $11.4 million, Metronome’s sETH-ETH pool hacked by $1.6 million and over 32 million in Curve DAO (CRV) tokens worth over $22 million drained over the past few hours. Decentralized exchange Ellipsis also reported that a small number of stable pools with BNB were exploited using an old Vyper compiler.</p> 
 <blockquote class="twitter-tweet"> 
  <p lang="en" dir="ltr">crv/eth pool drained minutes before a whitehack operation :(https://t.co/rhALBzkTEi</p>— banteg (@bantg) July 30, 2023 
 </blockquote> 
 <p>The incident also negatively affected CRV's price, which was down over 12% at the time of writing at $0.64. Community members also noted a potential ripple effect on Aave's protocol, as the falling price of CRV could force Curve's founder Michael Egorov to liquidate a $70 million borrowing position on Aave.</p> 
 <p><strong><em>Magazine: Should crypto projects ever negotiate with hackers? Probably</em></strong></p> 
 <template data-name="subscription_form" data-type="defi_newsletter"></template> 
</div>

Vyper vulnerability exposes DeFi ecosystem to stress tests

TheBitTimes

Other articles published on Aug 1, 2023

Stocks That Could Have Doubled the Investment for Investors YTD

Bitcoin due key MACD bull flag repeat as BTC price freezes at $29.3K

Curve Finance DeFi Platform Faces Major Exploit, CRV Tanks 16%

Nomura’s Crypto Arm Approved for Dubai License

Altman Refutes Worldcoin Disinterest With Japan Queues Video

Dubai’s VARA Grants Full Crypto License to Laser Digital

Join our free newsletter for daily crypto updates!