ParaSwap

when

<a href="https://cointelegraph.com/learn/defi-a-comprehensive-guide-to-decentralized-finance">Decentralized finance (DeFi)</a> aggregator ParaSwap discovered a vulnerability in its newly launched Augustus v6 contract and prevented a colossal loss of funds through timely white hat intervention.
On March 18, the ParaSwap Augustus v6 contract went live, aiming to improve swapping efficiency and reduce gas fees. However, the contract contained a critical vulnerability, allowing hackers to drain funds when approved.
Soon after discovering the vulnerability on March 20, ParaSwap paused the v6 application programming interface (API) and secured the potential victims’ funds through a white hat hack. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/d7d6a9d0-62fe-4d12-b6ab-073fc01a4438.jpeg" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/paraswap/status/1770313086072742263" target="_blank" rel="noopener nofollow"></a><a href="https://twitter.com/paraswap/status/1770313086072742263" target="_blank" rel="noopener nofollow">ParaSwap</a>
 </figcaption>
</figure>
ParaSwap advised all users to revoke permissions to the Augustus v6 contract to avoid further loss of funds until the vulnerability is neutralized. 
Despite ParaSwap’s proactive effort to roll back the vulnerable v6 contract and inform users to take necessary steps, the hacker managed to cash out funds worth roughly $24,000 from four different addresses. 
In total, ParaSwap <a href="https://paraswap.notion.site/Whitehack-addresses-35c56971a75d47d7b406e36c1ccb8fdb" target="_blank" rel="noopener nofollow">revealed</a> that 386 addresses were affected by the vulnerability. The protocol also asked users to report any loss of funds that may have gone unidentified during the preliminary investigation.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/fa157a19-858c-47c1-8fa2-411789a9f619.png" alt="" title="">
 <figcaption style="text-align: center;">
 ParaSwap identified 386 wallet addresses being affected by the&nbsp;Augustus Vv contract vulnerability. Source:&nbsp;paraswap.notion.site
 </figcaption>
</figure>
In addition, ParaSwap also deactivated the support for the vulnerable v6 contract on its recently updated user interface (UI) and reverted to using v5. “We have successfully recovered funds for all addresses, and more details about the refund process will be shared soon,” the company added.
ParaSwap did not immediately respond to Cointelegraph’s request for comment.
Affected users remain at risk as long as they haven’t revoked their approvals, and ParaSwap recommends individuals use exploit checker services like <a href="https://revoke.paraswap.cash/?=x%5C" target="_blank" rel="noopener nofollow">Revoke</a> to confirm their safety. Check out Cointelegraph’s guide on <a href="https://cointelegraph.com/news/5-smart-contract-vulnerabilities">how to identify and mitigate smart contract vulnerabilities</a>.
Related: <a href="https://cointelegraph.com/news/old-trust-wallet-ios-vulnerability-from-2018-may-still-affect-some-accounts">Old Trust Wallet iOS vulnerability from 2018 may still affect some accounts</a>
Generative artificial intelligence (AI) tools like the ChatGPT-4 are good at generating code. However, the tools fail to perform as a fully reliable security auditor.
According to a recently published research paper from a pair of researchers from Salus Security, a blockchain security company with offices in North America, Europe and Asia:
<blockquote data-ct-non-breakable="true">
 “GPT-4 can be a useful tool in assisting with smart contract auditing, especially in code parsing and providing vulnerability hints. However, given its limitations in vulnerability detection, it cannot fully replace professional auditing tools and experienced auditors at this time.”
</blockquote>
According to their findings, ChatGPT is good at detecting true positives — actual vulnerabilities that would be worth investigating outside of a testing environment. It reached greater than 80% precision in testing.
Magazine: <a href="https://cointelegraph.com/magazine/south-africa-digital-nomad-friendly-crypto-hub-cape-town-crypto-city-guide/">South Africa’s digital-nomad crypto hub: Cape Town, Crypto City Guide</a>

ParaSwap evades hack targeting Augustus v6 contract vulnerability

Cointelegraph

在 2024年3月20日發表的其他文章

Ethereum Foundation website changes hint at investigation by ‘state authority’

Regulatory Rift: Crypto Industry Demands Clear Guidelines in Face-Off with SEC

Bitcoin Price Turns Red Below $64K But Long-Term Uptrend Intact

Giggle Academy: Changpeng Zhao’s Vision for Universal Education

MATIC’s price is flashing a buy signal; here’s what you should do

Cryptocurrency Arbitrum's Price Increased More Than 6% Within 24 hours

訂閱免費電子報，每天收取加密貨幣最新動態！