Cryptocurrency

2024

DeFi

April

<p>Cryptocurrency and DeFi protocols have faced increasing problems due to vulnerabilities and resultant loss of funds. As the problems have continued, those identifying it have contributed to the benefit of the cause of decentralized finance. In a big discovery, a cybersecurity expert identified a vulnerability in Curve Finance protocol which could be used for withdrawal of funds from the liquidity pool.</p>
<h2 class="wp-block-heading" id="cryptocurrency-protocols-and-vulnerability">Cryptocurrency protocols and vulnerability&nbsp;</h2>
<p>There has been an estimate of losses <a href="https://de.fi/blog/de-fi-rekt-report-over-758m-lost-in-q3-2023" rel="noopener noreferrer nofollow" target="_blank">amounting to $758 million</a> due to vulnerabilities in DeFi protocols in Q3 of 2023. There have been a staggering 116 cases which show that there is an urgent need for enhancement of security. A workforce needs to be deployed for this purpose to identify vulnerabilities and address problems.&nbsp;</p>
<p>In a recent discovery, Curve Finance protocol has identified a vulnerability in the DeFi system. The vulnerability is of historical importance as it has resulted in the loss of millions of dollars for years. The vulnerability has resulted in hackers’ access to the protocol’s liquidity pool and drawing out funds.&nbsp;</p>
<p>There have been a range of security attacks in 2023 and major areas of focus for hackers included smart contract vulnerabilities, reentry attacks, and Oracle manipulation attacks. The first one is of critical importance because if a hacker is able to identify a vulnerability, they can use it for negative purposes, affecting the funds and security of the protocol.&nbsp;&nbsp;</p>
<p>Claim of a key vulnerability in <a href="https://www.cryptopolitan.com/curve-finance-defi-lending-contracts/" rel="noopener noreferrer nofollow">Curve Finance</a> and other protocols came from a cybersecurity expert Marc Croc. Belonging to Kupia security, Marc Croc said that the vulnerability resulted in the loss of funds from the liquidity pool. The mentioned cybersecurity expert also added that it has led to the loss of millions from various protocols.&nbsp;</p>
<h2 class="wp-block-heading" id="reentrancy-vulnerability-in-curve-finance">Reentrancy Vulnerability in Curve Finance</h2>
<p>Reenetracy vulnerability was verified by the developers’ team from <a href="https://www.cryptopolitan.com/curve-finance-defi-lending-contracts/" rel="noopener noreferrer nofollow">Curve Finance</a>. In a detailed overview, they were able to identify and confirm it. According to official sources, the bug could manipulate the balances of a DeFi protocol. The manipulation of balances could also result in the withdrawal of funds from the liquidity pool.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Big thanks for the disclosure! Grieving attacks are not as dangerous (funds would be anyway recoverable, and no profit for attacker) – could have caused serious panic if happened.<br><br>This is an example of a very professional work</p>— Curve Finance (@CurveFinance) <a href="https://twitter.com/CurveFinance/status/1785406648082997532?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">April 30, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>According to Curve Protocol sources, the bug didn’t pose an existential threat but it could create panic if any such incident took place. Furthermore, the company believed that they could recover funds in case such an incident took place. In July Curve Finance was able to recover funds amounting to $62 million which had been stolen after a vulnerability was exposed to hackers.&nbsp;</p>
<p>Furthermore, the protocol members agreed to return assets valuing $49.2 million to liquidity providers. It announced the recovery of ETH assets, CRV, and other assets that were recovered by whitehat hackers.&nbsp;</p>
<p>Curve protocol has brought forward a proposal the community fund will supply CRV tokens. The attackers identified a vulnerability in the Vyper language where problems were found in versions 0.2.15, 0.2.16, and 0.3.0.</p>
<h2 class="wp-block-heading" id="developer-rewarded-250k">Developer rewarded $250K</h2>
<p>It was a critical problem that would have created problems for the development team because of the increased panic amongst the users and investors. To face the problem promptly, a cybersecurity expert identified the problem, not revealing their identity.&nbsp;</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">🐞I reported a vulnerability in <a href="https://twitter.com/CurveFinance?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">@CurveFinance</a> and I am thrilled to share that I've been awarded a bug bounty of $250,000. 🧵</p>— Marco Croc (@malicator) <a href="https://twitter.com/malicator/status/1785376170608922675?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow" target="_blank">April 30, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<p>Once the problem was confirmed, the protocol awarded the whitehat maximum bug bounty of $250K. The whitehat shared the details in the X thread, thanking Curve Finance. Furthermore, the account shared the details of how the vulnerability would affect the protocol.&nbsp;</p>
<h2 class="wp-block-heading" id="conclusion">Conclusion</h2>
<p>In a recent tweet from a whitehat cybersecurity expert, Marc Croc announced the discovery of a vulnerability in Curve Finance. The development team confirmed and addressed the problem, announcing a bounty amount of $250K for the mentioned whitehat. Though the problem wasn’t an existential threat, it would have created a panic.</p>

Developer awarded $250 for finding reentrancy vulnerability by Curve Finance

Table of Contents

Cryptopolitan_News

Other articles published on May 1, 2024

Michael Saylor’s Bitcoin-Leveraged Strategy Transforming $1 Income to $400M Profit

Jack Dorsey’s Block Inc Is Under Federal Probe: Report

HIPPOSOL Set to Eclipse BONK as the Next Big Memecoin on Solana, Offering Early Investors with $H...

Curve Finance Rewards Security Researcher $250,000 for Uncovering Critical Vulnerability

Crypto Security Exploits See 141% Drop in a Month

Meme Coin BONK Susceptible to 50% Decline Amid Bearish Cues

Join our free newsletter for daily crypto updates!