Convergence

DeFi

Stake DAO

THORChain

Decentralized finance protocol Convergence has confirmed it was hacked via a smart contract exploit on Aug. 1, with a hacker minting and selling $210 million in its native token, as well as stealing $2,000 in unclaimed staking rewards.
According to a newly <a href="https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0" target="_blank" rel="noopener noreferrer nofollow">released</a> post-mortem from Wireshark, the pseudonymous founder of the Convergence protocol, the hacker exploited the protocol’s CvxRewardDistributor contract, allowing them to <a href="https://cointelegraph.com/explained/what-is-an-infinite-mint-attack-and-how-does-it-work" rel="noopener noreferrer nofollow">mint and sell</a> 58 million CVG tokens for approximately $210,000.
The hacker also stole approximately $2,000 of unclaimed <a href="https://cointelegraph.com/news/stablecoin-protocol-reserve-invests-convex-curve-stake-dao" rel="noopener noreferrer nofollow">rewards from Convex</a>, a DeFi protocol designed to maximize rewards for Curve liquidity providers.
<a href="https://etherscan.io/tx/0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9" target="_blank" rel="noopener noreferrer nofollow">According</a> to Etherscan, the attack occurred on Aug. 1 at around 3:00 am UTC.
Blockchain security firm PeckShield noted that after minting the CVG tokens, the hacker quickly swapped it into 60 wrapped-Ether and 15,900 Curve.fi FRAX.
The movements have since led to a near-100% price wipeout of the CVG governance token, which is now trading at $0.0004 with a market cap of just $57,000. CoinMarketCap data <a href="https://coinmarketcap.com/currencies/convergence-fi/" target="_blank" rel="noopener noreferrer nofollow">shows.</a>
<figure><img src="https://s3.cointelegraph.com/uploads/2024-08/a397f2ec-1a02-4fb1-9b7d-0cd4bc3164e2.png" alt="DeFi protocol removed an important line of code that led to a $212K hack">
 <figcaption style="text-align: center;">Source: <a href="https://x.com/peckshield/status/1819032859283186120" target="_blank" rel="noopener noreferrer nofollow">PeckShield</a>
 </figcaption>
</figure>
<h3 id="how-the-hack-happened">How the hack happened</h3>
Convergence said the attack was possible because the team accidentally removed an essential line of code in its smart contract, which distributes CVG <a href="https://cointelegraph.com/explained/what-is-liquid-staking-and-how-does-it-work" rel="noopener noreferrer nofollow">staking rewards</a>. They made the change after the smart contract code was audited four times.&nbsp;
“The modification (gas-optimization on the first hand) led us to remove the line of code that was checking the input given to the function,” it explained.&nbsp;
The hacker used this to exploit the CvxRewardDistributor contract through the claimMultipleStaking function.
This meant the staking contract couldn’t be validated, allowing the hacker to pass a separate malicious contract with the same signature as the claimCvgCvxMultiple function.
The hacker then minted all tokens dedicated to staking emissions and then dumped them into CVG liquidity pools, Convergence said.&nbsp;
<blockquote>
 “We apologize to our community and investors, and we take full responsibility for what happened.”
</blockquote>
Related:<a href="https://cointelegraph.com/news/cefi-hacks-2024-cyvers-ai-security" rel="noopener noreferrer nofollow"> Over 70% of hacked funds are lost to CeFi entities — Cyvers</a>
Convergence says that user funds are safe, but has recommended users withdraw assets from the platform.
“Due to the exploit, the rewards contract for the Stake DAO integration is currently broken. It will be fixed, and stakers will be able to claim their rewards once it’s done. No rewards are lost for Stake DAO integration users," it said.&nbsp;
<blockquote>
 "We will soon communicate about the possibilities for the future of the protocol."
</blockquote>
Convergence works to aggregate liquidity, boost returns and enable liquid locking across the Curve Finance ecosystem.
The total value locked on Convergence fell from $5.79 million to $3.69 million, DefiLlama data <a href="https://defillama.com/protocol/convergence-fi?staking=true&amp;tvl=true" target="_blank" rel="noopener noreferrer nofollow">shows.</a>
The cryptocurrency ecosystem <a href="https://cointelegraph.com/news/july-2024-crypto-hacks-analysis" rel="noopener noreferrer nofollow">lost around $266 million</a> to hacks in July, mostly coming from the <a href="https://cointelegraph.com/news/indian-crypto-exchange-wazirx-hack-235m" rel="noopener noreferrer nofollow">$230 million hack</a> of Indian trading platform WazirX on July 18.
Magazine:<a href="https://cointelegraph.com/magazine/thorchain-founder-jp-thor-vampire-attack-defi/" rel="noopener noreferrer nofollow"> THORChain founder and his plan to ‘vampire attack’ all of DeFi</a>

DeFi protocol removed an important line of code that led to a $212K hack

Table of Contents

Cointelegraph

Other articles published on Aug 2, 2024

The Ultimate Guide to the Best Ongoing Presales in 2024: Featuring Hoge Finance

Russia Advances Crypto and Mining Regulations as US Sanctions Impact Economy

Ethereum Whales Buy $440 Million In ETH In One Day, Do They Know Something You Don’t?

Donald Trump Launches Bitcoin-Themed Sneakers, Quickly Sell Out

BenFen Mainnet 1.0: Pioneering a New Era

Trump Supports Bitcoin at Conference

Join our free newsletter for daily crypto updates!