Ethereum

Mozaic

ParaSwap

Arbitrum

Tornado

An old contract previously used by the Dolomite crypto exchange has been exploited for approximately $1.8 million, according to a March 20 report from blockchain security platform CertiK and seen by Cointelegraph. The exploit affected users who previously authorized approvals to the contract, and the development team recommended revoking approvals to the Ethereum Dolomite address that begins with 0xe2466.&nbsp;
The development team claimed that users who have only interacted with the current version on Arbitrum should not be affected. They have also disabled the faulty contract, which should protect users who have not yet become victims of the attack. Even so, the team argued that users should revoke approvals to this contract.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-03/9e098011-0716-4496-b0eb-bdd1349a7602.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: Dolomite
 </figcaption>
</figure>
Dolomite is a decentralized exchange and money market protocol that currently runs on Arbitrum and Polygon zkEVM. It originally <a href="https://cointelegraph.com/news/dolomite-dex-to-launch-margin-trading-with-stop-loss-orders">launched</a> on Ethereum in 2019. The team migrated it to the Arbitrum network in 2022 and gradually phased out support for the Ethereum version. Because of the immutable nature of smart contracts, users can still interact with its Ethereum version using developer tools.
According to the CertiK report, the attacker <a href="https://twitter.com/CertiKAlert/status/1770496742464557303" target="_blank" rel="noopener nofollow">exploited</a> a function named “callFunction” that allows a user to make any arbitrary calls. This function is guarded by a “noEntry” modifier, which under normal circumstances, should prevent any reentrancy attacks. However, this guard can be bypassed by the TradeManager contract located at 0xe2466, which contains a “call” function that has no reentrancy guard. Thus, the attacker was able to use this contract to drain funds from users, CertiK claimed.
The attacker transferred all of the stolen funds to address 0x5eAA7DadA44d59549A6c58008b2bd3C7F81d2502 and then deposited them into Tornado cash, Certik stated.
Related: <a href="https://cointelegraph.com/news/paraswap-hack-augustus-v6-contract-vulnerability">ParaSwap evades hack targeting Augustus v6 contract vulnerability</a>
This exploit is one of several that have occurred in March. On March 11, the Unizen protocol on Ethereum <a href="https://cointelegraph.com/news/unizen-hack-immediate-refund">lost over $2.1 million</a> due to an approval exploit. In that case, the development team promised to reimburse users as soon as possible. On March 15, Mozaic Finance <a href="https://cointelegraph.com/news/mozaic-finance-hacked-2-4-million-private-key-compromise">lost over $2.4 million</a> due to a private key compromise.

Old Dolomite exchange contract suffers $1.8M loss from approval exploit

Cointelegraph

Other articles published on Mar 20, 2024

Bitcoin, Ethereum rebound but still show ‘overheated signals’ — K33 Research

Shiba Inu’s Shibarium Sees Staggering 99% Decline In Transactions, What’s Happening?

Tokens to Watch in Q2 2024 – Algotech (ALGT), Render Token (RNDR) and Avalanche (AVAX)

25% of IT Leaders Regret Rushing into AI Investments, Says Report

Bitget lists Paysenger (EGO) token in the Innovation and SocialFi Zones (20 Mar)

$670 Million Liquidated In Crypto As Traders Await Fed Guidance At FOMC

Join our free newsletter for daily crypto updates!