Dough

Compound

Million

USDC

Read

The post <a href="https://coinpedia.org/news/dough-finance-hit-by-1-96-million-exploit-user-funds-at-risk/" rel="noopener noreferrer nofollow">Dough Finance Hit by $1.96 Million Exploit: User Funds at Risk</a> appeared first on <a href="https://coinpedia.org" rel="noopener noreferrer nofollow">Coinpedia Fintech News</a>
In a rather disheartening event for the community, Dough Finance has been drained for nearly $1.8&nbsp; million in the <a href="https://markets.coinpedia.org/usd-coin/" target="_blank" rel="noopener noreferrer nofollow">USDC</a> with subsequent attacks increasing the total loss to $1.96 million. The leakage has raised many users’ suspensions with their money and has made them doubt the safety of the service.
<h2 class="wp-block-heading" id="h-what-happened">What happened?</h2>
According to <a href="https://x.com/CertiKAlert/status/1811668992882307478" target="_blank" rel="noopener noreferrer nofollow">CertiK alerts</a>, its root cause could be traced back to ConnectorDeleverageParaswap contract in which calldata was not validated during flash loan calls. Due to this, the attacker had the privilege to alter the data to his benefit. The primary vulnerability lied in the unvalidated call data within the contract. The contract didn’t properly check the data it received during flash loan calls, allowing the attacker to manipulate it for their benefit.
Using the funds obtained through Railgun, the attacker managed to quickly change the stolen USDC into <a href="https://markets.coinpedia.org/ethereum/" target="_blank" rel="noopener noreferrer nofollow">ETH</a>, thus making identification and return of the money almost impossible.
After the first attack, the attacker remained active and decided to attack Dough Finance again which caused further losses of $140,498 and raised the overall loss to $1. 96 million.
<h2 class="wp-block-heading" id="h-who-were-the-most-impacted">Who were the most impacted?</h2>
Users who had their funds deposited in the Dough Finance exploited contract were the most affected. Users associated with AAVE do not feel the impact of this breach because it targeted Dough Finance contracts and no AAVE pools.
What Should Users Do?&nbsp;
&nbsp;1. Any funds that users have on Dough Finance, should be withdrawn to a safe wallet especially if they are in the affected contracts.&nbsp;
&nbsp;2. Follow the updates from the Dough Finance team for further instructions on actions and more.&nbsp;
&nbsp;3. Avoid any contact with the Dough Finance protocol or any of its contracts until it is cleared as completely safe.&nbsp;
While the team behind Dough Finance is looking into the breach and is trying to mitigate damages, people are encouraged to get acquainted with the new information in the official media and protect their property from possible damage.
Read Also: <a href="https://coinpedia.org/news/compound-labs-website-breach-security-restored-smart-contracts-safe/" target="_blank" rel="noopener noreferrer nofollow">Compound Labs Website Breach: Security Restored, Smart Contracts Safe</a>

Dough Finance Hit by $1.96 Million Exploit: User Funds at Risk

Table of Contents

CoinPedia News

Other articles published on Jul 12, 2024

New memecoin to watch: Shiba Shootout ICO takes aim at $1m milestone

Genesis Trading-labelled address moves $720M BTC to Coinbase, pointing to the start of asset liqu...

Bitcoin Traders Succumb to “Extreme Fear”

BAXUS Transforms Whiskey Financing with Tokenized Loans

Bitcoin predictions turn bearish: Should you prepare for more losses?

Genesis Trading Offloaded 12K BTC From Huge 45K Bitcoin Stash

Join our free newsletter for daily crypto updates!