Alchemix

Metronome

Security

A security researcher was rewarded $250,000 for discovering a vulnerability that has historically allowed hackers to pull out millions of dollars from cryptocurrency protocols.&nbsp;
Pseudonymous cybersecurity researcher Marco Croc from Kupia Security identified a reentrancy vulnerability in decentralized finance (DeFi) protocol Curve Finance. 
In an X thread, he <a href="https://twitter.com/malicator/status/1785376170608922675" target="_blank" rel="noopener nofollow">explained</a> how the bug could be exploited to manipulate balances and withdraw funds from liquidity pools.
Curve Finance acknowledged potential security flaws and “recognized the severity of the vulnerability,” Marco Croc explained. After a thorough investigation, Curve Finance awarded Marco Croc its maximum bug bounty award of $250,000. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/1acab850-86b4-4c94-82c8-ad48a2341741.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/CurveFinance/status/1785406648082997532" target="_blank" rel="noopener nofollow">Curve Finance</a>
 </figcaption>
</figure>
According to Curve Finance, the threat was classified as “not as dangerous,” and they believed they could recover the stolen funds in such a case.&nbsp;
However, the protocol said a security incident of any scale “could have caused serious panic if it had happened.”
Related: <a href="https://cointelegraph.com/news/curve-finance-debt-cause-one-more-stress-test-february-analyst">Curve Finance debt will cause 'one more stress test' in February — Analyst</a>
Curve Finance recently recovered from a $62 million hack in July. As part of returning to normalcy, the DeFi protocol voted to reimburse $49.2 million worth of assets to the liquidity providers (LPs). 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-05/b493ce71-a447-407d-9c98-074f36a330b3.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/CurveFinance/status/1737998103188553846" target="_blank" rel="noopener nofollow">Curve Finance</a>
 </figcaption>
</figure>
On-chain data confirms that 94% of tokenholders approved the disbursement of tokens worth over $49.2 million to cover the losses of the Curve, JPEG’d (JPEG), Alchemix (ALCX) and Metronome (MET) pools.
According to Curve’s proposal, the community fund will supply the Curve DAO (CRV) tokens. The final amount also includes a deduction for the tokens recovered since the incident.
“The overall ETH&nbsp;to recover was calculated as 5919.2226 ETH, the CRV to recover was calculated as 34,733,171.51 CRV and the total to distribute was calculated as 55’544’782.73 CRV,” reads the proposal.
The attacker exploited a vulnerability on stable pools using some versions of the Vyper programming language. The bug made Vyper’s 0.2.15, 0.2.16 and 0.3.0 versions vulnerable to reentrancy attacks.
Magazine: <a href="https://cointelegraph.com/magazine/runes-supporters-unlock-bitcoins-potential/">68% of Runes are in the red — Are they really an upgrade for Bitcoin?</a>

Curve Finance awards dev $250K for finding reentrancy vulnerability

Cointelegraph

Other articles published on May 1, 2024

INTERPOL: Extradition Papers Ready for Binance’s Anjarwalla

First Cryptocurrency Statement After the Penalty from Binance Founder CZ!

Aave Labs Announces Upcoming V4 Developments

Coinbase Increases Bitcoin Transaction Speeds With Complete Integration Of Lightning Network

Bitcoin ETFs Reduce Holdings While Blackrock Stalls Purchases

Crypto: Europe is preparing for the implementation of MiCA

Join our free newsletter for daily crypto updates!