Ethereum

The on-chain detective and the JPEG’d team believe that one of the developers working on the Bancor network and the web3.py Python library may be involved in the DEX hack.Today, prominent blockchain sleuth ZachXBT and the team behind the JPEG’d project contacted Michael Razoum with a proposed white hat bounty. According to the Web3 detective, Razoums address is &#34;tied on-chain to the recent Curve Pool exploit&#34; that took place on July 30 due to the reentrancy vulnerability in the Vyper contract-oriented programming language.ZachXBT has not revealed any particular details about the developer who may be responsible for the attack on Curve, a decentralized exchange based on liquidity pools. Yet, some members of the crypto community on Twitter have <a href="https://twitter.com/0xQuit/status/1686540867279208453" rel="noopener noreferrer nofollow">identified</a> the developer as a contributor to the web3.py Python library designed to interact with Ethereum as well as the Bancor network, which is &#34;an ecosystem of decentralized, open-source DeFi protocols that foster on-chain trading and liquidity,&#34; according to the project’s official website.Read also: <a href="https://coinpaper.com/1652/zach-xbt-receives-threats-in-the-midst-of-preparing-for-the-legal-battle-against-machi-big-brother" rel="noopener noreferrer nofollow">ZachXBT receives threats amid preparations for legal battle against MachiBigBrother</a>The developer&#39;s response to <a href="https://jpegd.io/" rel="noopener noreferrer nofollow">JPEG’d</a>, &#34;an experimental protocol bridging the gap between DeFi and NFTs,&#34; is still unknown. Interestingly, the JPEG’d team previously <a href="https://twitter.com/JPEGd_69/status/1685655792274341888" rel="noopener noreferrer nofollow">announced</a> that the project’s contracts were not affected by the hack, while &#34;the vault contracts that allow borrowing against NFTs were secure and still running solidly&#34; and &#34;NFTs and the treasury funds were safe.&#34;Although blockchain analytics firm CertiK <a href="https://twitter.com/CertiK/status/1686433847313887232" rel="noopener noreferrer nofollow">reports</a> that white hats have managed to recover nearly $17 million of the $69.3 million Curve lost, the company claims the incident has been &#34;the largest reentrancy attack so far in 2023.&#34;Read also: <a href="https://coinpaper.com/1704/beosin-reports-more-instances-of-rug-pulls-in-h1-2023-totaling-nearly-76-million-compared-to-the-number-of-hacks-responsible-for-nearly-470-million-in-losses" rel="noopener noreferrer nofollow">Total losses from hacks drop fourfold compared to 2022</a>One of the most notable recovery actions was the acquisition of 2,800 ETH worth $5.2 million at press time by a mev bot run by the pseudonymous white hat Coffeebabe.eth. Mev bots are designed to explore the blockchain and conduct transactions that could be profitable for traders with larger amounts of gas. The one developed by Coffeebabe.eth managed to complete the transaction before the hacker and its deployer reportedly returned the cryptocurrency to Curve.At the time of publication, there were several versions of Vyper, the language developed specifically for the Ethereum Virtual Machine. As per CertiK, three of them, 0.2.15, 0.2.16, and 0.3.0, &#34;were vulnerable to malfunctioning reentrancy locks,&#34; that allowed hackers to perform a &#34;reentrancy attack targeting the pETH- ETH -f pool.&#34;This form of exploitation is possible due to a reentrancy vulnerability that allows hackers to call a function multiple times while its previous call has not yet been completed. As in the case of Vyper, this provides the opportunity to drain funds. According to CertiK, the add and remove liquidity functions used in Vyper lacked the &#34;nonReentrant&#34; modifier, which is crucial to prevent smart contracts from calling themselves.Meanwhile, the most current versions of code libraries seem to be resistant to this type of an attack. Fortunately, some of the major platforms that use Vyper have managed to update their applications in time. One of them is crypto exchange giant Binance, which <a href="https://twitter.com/cz_binance/status/1685909293256646658" rel="noopener noreferrer nofollow">stated</a> that it used Vyper version 0.3.7 and higher at the time of the exploit. CertiK strongly recommends that projects using the versions of Vyper that contain the vulnerability upgrade to the latest versions of the language.<a href="https://coinpaper.com/1848/zach-xbt-tracks-down-developer-potentially-involved-in-curve-exploit?utm_source&#61;referral&amp;utm_medium&#61;publish0x&amp;utm_campaign&#61;zachxbt-curve-pool" rel="noopener noreferrer nofollow">Read the full article on Coinpaper.</a>

ZachXBT Tracks Down Developer Potentially Involved in Curve Exploit

Coinpaper.com

Other articles published on Aug 3, 2023

Popular Crypto Trading Channel, Tone Vays, Banned On Youtube

Bitcoin Halving : Vers une envolée à 150k$, selon Pantera Capital

Crypto News: Is Binance Purchasing BTC To Defend BNB?

Hong Kong debuts retail crypto trading with HashKey exchange

"August ICO Bonanza: Unveiling Upcoming & Ongoing ICOs!"

SQUID Game (SQUID) Token on Ethereum is launching on Uniswap this Friday, August 4, 2023, at 10 G...

Join our free newsletter for daily crypto updates!