crvUSD

Alchemix

Ellipsis

<p>Late yesterday evening, Curve Finance suffered a re-entry attack. Provisional reports of the hack indicated a loss of some $26 million. Except that it was a long night for the Curve team, and so was the list of break-ins. According to the latest news, the total amount of money stolen is in the region of $52 million.</p> 
<h2 id="panic-over-curve-hack">Panic over Curve hack</h2> 
<p>The DeFi ecosystem is crying right now. After a major attack on the Curve protocol was reported, resulting in the loss of around $11 million, things have taken a turn for the worse.</p> 
<div class="my-4"> 
 <div class="ads " data-location="1"> 
 </div> 
</div> 
<figure class="wp-block-embed aligncenter is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <div class="entry-content-asset"> 
   <div class="social-embed-container"> 
    <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
     <p lang="en" dir="ltr">Update <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> There are ~$52M exploited so far from <a href="https://twitter.com/AlchemixFi?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@AlchemixFi</a>, <a href="https://twitter.com/JPEGd_69?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@JPEGd_69</a>, <a href="https://twitter.com/MetronomeDAO?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@MetronomeDAO</a>,<a href="https://twitter.com/deBridgeFinance?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@DebridgeFinance</a>, <a href="https://twitter.com/Ellipsisfi?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Ellipsisfi</a> and <a href="https://twitter.com/hashtag/Curve?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Curve</a> CRV-ETH <a href="https://t.co/o1j83HgCB3" rel="noopener noreferrer nofollow">https://t.co/o1j83HgCB3</a> <a href="https://t.co/OoI6KyL05e" rel="noopener noreferrer nofollow">pic.twitter.com/OoI6KyL05e</a></p>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1685794015915229184?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 30, 2023</a> 
    </blockquote> 
    <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
   </div> 
  </div> 
 </div> 
 <figcaption class="wp-element-caption">
   Curve has been bleeding since last night 
 </figcaption> 
</figure> 
<p>Some time earlier, PeckShield reported that a total of $26.76 million had been stolen from Curve Finance.</p> 
<p>According to BeInCrypto, this “reentrancy attack” did not only affect Curve’s stable pools. Damage was also reported to other DeFi protocols such as Ellipsis (huge losses in BNB), JPEG’d ($11.4 million), Alchemix ($13.6 million), MetronomeDAO ($1.6 million)… The ecosystem as a whole plummeted, to the point of posting a $2.3 billion drop in its TVL.</p> 
<p>To make matters worse, the CRV lost 16% of its value in 24 hours. At the time of going to press, it was trading at $0.064. A fine performance compared with the Curve’s 11:15pm Sunday price of $0.59.</p>  
<div class="tradingview-widget-container tradingview--mini-chart"> 
 <div class="tradingview-widget-container__widget"></div> 
 <div class="tradingview--mini-chart--dark"> 
  <script type="text/javascript" src="https://s3.tradingview.com/external-embedding/embed-widget-mini-symbol-overview.js" async>{"symbol":"BINANCE:CRVUSD","width":350,"height":220,"isTransparent":false,"autosize":false,"dateRange":"12M","trendLineColor":"rgba(253,64,19,1)","underLineColor":"rgba(253,64,19,0.6)","underLineBottomColor":"rgba(253,64,19,0)","locale":"en","largeChartUrl":false,"colorTheme":"dark"}</script> 
 </div> 
 <div class="tradingview--mini-chart--light"> 
  <script type="text/javascript" src="https://s3.tradingview.com/external-embedding/embed-widget-mini-symbol-overview.js" async>{"symbol":"BINANCE:CRVUSD","width":350,"height":220,"isTransparent":false,"autosize":false,"dateRange":"12M","trendLineColor":"rgba(253,64,19,1)","underLineColor":"rgba(253,64,19,0.6)","underLineBottomColor":"rgba(253,64,19,0)","locale":"en","largeChartUrl":false,"colorTheme":"light"}</script> 
 </div> 
 <div class="tradingview-widget-copyright"> <a href="https://fr.tradingview.com/symbols/CRVUSD/?exchange=BINANCE" rel="noopener noreferrer nofollow" target="_blank"><span class="text-primary-color">CRVUSD chart</span></a> by TradingView 
 </div> 
</div>  
<h2 id="vyper-the-main-culprit">Vyper, the main culprit</h2> 
<p>The re-entry attack that bled Curve Finance would not have happened if Viper had done its job. This intelligent Pythonic smart contract language for EVM presented vulnerabilities to the point of allowing these heavy losses.</p> 
<figure class="wp-block-embed aligncenter is-type-rich is-provider-twitter wp-block-embed-twitter"> 
 <div class="wp-block-embed__wrapper"> 
  <div class="entry-content-asset"> 
   <div class="social-embed-container"> 
    <blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
     <p lang="en" dir="ltr">A number of stablepools (alETH/msETH/pETH) using Vyper 0.2.15 have been exploited as a result of a malfunctioning reentrancy lock. We are assessing the situation and will update the community as things develop.<br><br>Other pools are safe. <a href="https://t.co/eWy2d3cDDj" rel="noopener noreferrer nofollow">https://t.co/eWy2d3cDDj</a></p>— Curve Finance (@CurveFinance) <a href="https://twitter.com/CurveFinance/status/1685693202722848768?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 30, 2023</a> 
    </blockquote> 
    <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
   </div> 
  </div> 
 </div> 
 <figcaption class="wp-element-caption">
   Curve denounces the culprit 
 </figcaption> 
</figure> 
<p><a href="https://coinpedia.org/news/defi-world-shaken-by-47m-heist-curve-finance-attacked/" target="_blank" rel="noopener noreferrer nofollow">CoinPedia</a>, which picked up the results of a survey conducted by Ancilia, puts forward these details:</p> 
<ul> 
 <li>136 smart contracts were using Vyper 0.2.15;</li> 
</ul> 
<ul> 
 <li>98 of these are deployed on Vyper 0.2.16;</li> 
</ul> 
<ul> 
 <li>And 226 smart contracts on Vyper 0.3.0.</li> 
</ul> 
<p>All this stems from a faulty re-entry lock conducive to massive, simultaneous transfers from other DeFi protocols.</p> 
<p>The damage is done. And no one has learned the lessons of the EraLend re-entry attack that resulted in the theft of several million dollars.</p> 
<h2 id="curve-finance-saved-by-white-hat-hackers">Curve Finance saved by white hat hackers</h2> 
<p>Some analysts suggest that Curve’s attack may be worth more than $70 million. While most of this is currently in the hands of the wrong people, some of the funds have been recovered by good hackers, white hats and MEV bots.</p> 
<div class="my-4"> 
 <div class="ads " data-location="2"> 
 </div> 
</div> 
<p>One whitehat hacker holding the address “cOffeebabe.eth” claimed to have returned 2,879 ETH ($5.4 million) to the deployment address reported by Curve.</p> 
<p>But this noble initiative, coupled with stability in crvUSD contracts, won’t stop the hemorrhaging of Curve Finance, which has recorded 32 million CRV tokens in losses.</p> 
<p>Many questions are currently being asked, despite the Curve Finance CEO’s somewhat belated attempts at redress. Michel Egorov has made up for his team’s blunder by repaying USDT 4.63 million and depositing CRV 16 million on Aave. At present, he has debts of 59.68 million USDT on Aave, with a health rate of 1.69, according to <a href="https://mpost.io/the-aftermath-of-the-curve-finance-hack/" target="_blank" rel="noopener noreferrer nofollow">Metaverse Post</a>.</p> 
<p>The white hat hackers’ approach to all this is commendable. Like last time, Binance and the other exchanges will also be able to lend a hand to avoid a bloodless DeFi. At the very least, they will freeze the assets stolen from Curve Finance.</p>

DeFi on high alert: Heavy toll for Curve Finance

Table of Contents

Cointribune EN

Other articles published on Aug 1, 2023

XRP ADX/DI and MACD Cross Bullish on Monthly Charts

8 Ways You Can Make Money On New X (Ex-twitter)

Get Set, Go! It's Time for the Twitter Handles Contest!

Meta committed to metaverse despite $3.7b Q2 loss

VC Spectra (SPCT) Price Prediction 2023: Could It Reach $0.08?

What Are NFT Royalties?

Join our free newsletter for daily crypto updates!