2024

DeFi

April

Rewards

A pseudonymous cybersecurity expert Marco Croc, received a $250K reward for discovering a significant flaw in the Curve Finance decentralized finance (DeFi) protocol. This vulnerability, called reentrancy, had allowed hackers to steal millions from cryptocurrency protocols in the past. 
In a detailed explanation on an online forum, Marco Croc outlined how this bug could be used to manipulate balances and withdraw funds from liquidity pools within Curve Finance. 
Curve Finance acknowledged the seriousness of the issue and awarded Marco Croc $250,000 as a bug bounty, the highest amount they offer.&nbsp; 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 🐞I reported a vulnerability in <a href="https://twitter.com/CurveFinance?ref_src=twsrc%5Etfw" target="_blank" rel="noopener" data-wpel-link="external">@CurveFinance</a> and I am thrilled to share that I've been awarded a bug bounty of $250,000. 🧵— Marco Croc (@malicator) <a href="https://twitter.com/malicator/status/1785376170608922675?ref_src=twsrc%5Etfw" target="_blank" rel="noopener" data-wpel-link="external">April 30, 2024</a>
 </blockquote> 
 </div>
</figure> 
While Curve Finance believed they could recover any stolen funds, they recognized the potential for panic if such an incident occurred. According to Curve Finance, the threat was “not as dangerous.” 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 Big thanks for the disclosure! Grieving attacks are not as dangerous (funds would be anyway recoverable, and no profit for attacker) – could have caused serious panic if happened. This is an example of a very professional work— Curve Finance (@CurveFinance) <a href="https://twitter.com/CurveFinance/status/1785406648082997532?ref_src=twsrc%5Etfw" target="_blank" rel="noopener" data-wpel-link="external">April 30, 2024</a>
 </blockquote> 
 </div>
</figure> 
This discovery came after Curve Finance had recently experienced a $62 million hack in July. To return to normal operations, the DeFi protocol decided to reimburse $49.2 million worth of assets to liquidity providers (LPs). 
Data from the blockchain confirmed that 94% of token holders approved the disbursement of tokens to cover the losses in various pools affected by the hack. 
The recovery plan involved utilizing the Curve DAO (CRV) tokens from the community fund, with adjustments made for any tokens already recovered. 
The vulnerability exploited by the attacker affected stable pools using specific versions of the Vyper programming language. Versions 0.2.15, 0.2.16, and 0.3.0 of Vyper were found to be vulnerable to reentrancy attacks. 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 Also Read: <a href="https://www.cryptotimes.io/2024/04/27/bitget-introduces-mine-promotion-to-reward-crypto-traders/" target="_blank" rel="noreferrer noopener" data-wpel-link="internal">Bitget Introduces “Mine Promotion“ to Reward Crypto Traders</a> 
</blockquote>

Curve Finance Rewards Dev $250K for Vulnerability Discovery

The Crypto Times

Other articles published on May 1, 2024

Investors Add DTX Exchange (DTX) Token In Portfolio for 100X ROI as XRP Price Continues Downtrend

Bitcoin’s price crashes below $58,000 – Which way will BTC go now?

Bitcoin Assets Worth $175 Billion Secured by ETFs, Countries, and Companies: VanEck

Bitcoin Greed No More: Sentiment Back At Neutral After $57,000 Plunge

Pepe Price Prediction: PEPE Plummets 8% As Investors Flock To This Multi-Chain Dogecoin Derivativ...

DCA Altcoins To Buy on The Dip?

Join our free newsletter for daily crypto updates!