Bounty

Alchemix

Decentralized finance (DeFi) protocol Curve is offering a $1.85 million reward to anyone who can identify the exploiter responsible for draining over $61 million from its pools on July 30. This announcement was made after the deadline for the voluntary return of funds expired. 
The exploiter used vulnerable versions of the Vyper programming language to launch reentrancy attacks on targeted stable pools, leading to significant losses. Following the attack, Curve and other affected protocols offered a 10% bug bounty to the exploiter, totaling more than $6 million. 
In response, the hacker returned stolen assets to two projects, Alchemix and JPEGd, but did not refund other affected pools. 
What is a reentrancy attack?A reentrancy attack, the method used by the exploiter in this case, is a common security vulnerability in smart contracts, especially those running on blockchain platforms like Ethereum. In a nutshell, a reentrancy attack allows an attacker to repeatedly call a functiorn in a smart contract while a previous call to that same function has not yet finished executing. 
The Vyper programming language, which was used to build the targeted stable pools in this case, is a contract-oriented language similar to Solidity, another popular language for writing smart contracts on Ethereum. While Vyper is designed with a stronger emphasis on security and simplicity, it is not immune to reentrancy attacks, which are a pervasive problem in the world of smart contracts. 
During a reentrancy attack, an exploiter can drain funds from a contract by recursively calling a function that withdraws funds. In this case, the exploiter managed to drain more than $61 million from several of Curve's stable pools, illustrating the severity of the attack and the poterntial impact of these types of vulnerabilities in the DeFi space. 
The incident underscores the importance of proper security practices and rigorous code review in the development of smart contracts. Despite the relative maturity of DeFi, the risk of smart contract vulnerabilities like reentrancy attacks remains, necessitating ongoing vigilance and robust security measures from DeFi projects.What's at stake for Curve Finance? 
Curve has now extended its bounty to the public, promising a reward equivalent to 10% of the remaining exploited funds (currently $1.85 million) to anyone who can identify the exploiter in a way that results in legal conviction. However, the firm has stated that it will not pursue the issue further if the exploiter chooses to return the stolen funds in full. 
Prior to returning some of the funds, the exploiter had sent a message to the Alchemix and Curve teams, stating that they were refunding the money not because the teams could find them, but because they didn't want to ruin the projects. 
The July 30 attack targeted several of Curve’s pools, including those of Alchemix, JPEGd, and Metronome, resulting in significant losses. The exploit exposed vulnerabilities across DeFi projects and triggered industry-wide efforts to recover stolen funds. 
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Curve Finance Opens $1.85m Bounty To Identify Threat Actor

Crypto Daily™

在 2023年8月7日發表的其他文章

US House Member Speaks About PayPal's Stablecoin Move! "It's time!"

Paramount Stock: Will PARA stock rally toward $20 after Earnings?

Tether market cap rising, InQubeta presale raises over $2 million

DOGE Entry Zone Suggested by Trading Expert as Price Fails to Breach $0.07 This Weekend

Ethereum Investors Await Rally as Addresses in Profits Hit Montly Low

Shiba Inu Whales Accumulate 1 Trillion SHIB in 8 Weeks As New Wave Of Investors Prepare to Join D...

訂閱免費電子報，每天收取加密貨幣最新動態！