Convergence

WETH

DeFi

Convergence, a DeFi protocol, was the victim of a hack in which the attackers looted $210,000 worth of its native token and $2,000 in unclaimed staking rewards. Convergence sent out a <a href="https://x.com/Convergence_fi/status/1819032027842113959" target="_blank" rel="noopener nofollow">post</a> warning its users not to interact with the protocol after news of the exploit broke. 
Security platform PeckShield initially shared the details of&nbsp;<a href="https://x.com/peckshield/status/1819032859283186120" target="_blank" rel="noopener nofollow">the hack</a> through one of their X posts. According to the post, the hacker minted 58 million CVG tokens. Following the hack, the tokens were converted to 60 WETH and 15.9k crvFRAX. 
<h3 id="span-style-font-weight-400-convergence-releases-post-mortem-span">Convergence releases post-mortem&nbsp;&nbsp;</h3> 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 It seems <a href="https://twitter.com/Convergence_fi?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@Convergence_fi</a> was just exploited (w/ ~$210k loss) to mint 58m <a href="https://twitter.com/search?q=%24CVG&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">$CVG</a> (58,718,395.05681812), which are swapped to 60 WETH and 15.9k crvFRAX. 
 The bug is part of the CvxRewardDistributor contract, which does not validate the (untrusted) user input to claim rewards. 
 Here… <a href="https://t.co/EOS7q4reUC" rel="nofollow" target="_blank">pic.twitter.com/EOS7q4reUC</a> 
 — PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1819032859283186120?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">August 1, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The <a href="https://medium.com/@cvg_wireshark/post-mortem-08-01-2024-e80a49d108a0" target="_blank" rel="noopener nofollow">post-mortem</a> revealed that the primary reason for the exploit is a lack of validation in the input given by the user in the function “claimMultipleStaking” of the reward distribution contract. According to the report, the hacker executed the malicious contract without the validation of the staking contract. This allowed the hacker to mint all tokens that were kept aside for staking emissions. 
Following the hack, the hacker dumped all the newly minted CVG tokens into liquidity pools. 
<h3 id="span-style-font-weight-400-convergence-blames-p-span-span-style-font-weight-400-ost-span-span-style-font-weight-400-audit-modification-for-exploit-span">Convergence blames ‘post-audit modification’ for exploit</h3> 
Convergence Finance mentioned in its post-mortem report that the protocol has been audited 4 times by various companies. However, the protocol had recently modified the compromised part of the code post-audit. 
According to the team, “The modification (gas-optimization on the first hand) led us to remove the line of code that was checking the input given to the function. We apologize to our community and investors, and we take full responsibility for what happened.” 
However, the team assures that all user funds are safe. In what seems like an additional cautionary measure, it also asked investors to withdraw their staked assets. 
Following the hack, the rewards contract also got exploited. As a result, stakers will not be able to claim their rewards now. Convergence stated that it is working on a fix, and a resulting will soon be communicated. 
Crypto hacks have been on the rise lately. The industry witnessed 16 reported crypto hacks, which contributed to the loss of over <a href="https://www.cryptopolitan.com/16-crypto-hacks-266m-losses-july/" target="_blank" rel="noopener">$266 million in July</a>.

Post-mortem of Convergence $210,000 DeFi protocol hack emerges

Table of Contents

Cryptopolitan_News

Other articles published on Aug 2, 2024

Jasmy Technologies is Shaping Japan’s Future with AI, Robotics, and IoT; Analyst Projects $0.62 P...

Coinbase reports $1.4B revenue for Q2: How ETFs helped profits

Uniswap Token In The Red As It’s Fails To Capture Investors For The Longterm; Ethereum & Rollbloc...

OKX's Venture Arm and Aptos Foundation Announce $10M Fund to Boost Aptos Ecosystem

Saying that the risk of decline in Bitcoin is not over, the analyst announced the level that shou...

Analyst Predicts Key Breakout and Buying Opportunities for Cardano (ADA)

Join our free newsletter for daily crypto updates!