Tornado

Sturdy

<p>Sturdy Finance – a DeFi project promising up to 10x leverage on staked assets – has been exploited by a hit-and-run attack on its pricing oracle.</p>
<p>Although the amount stolen (worth about $800k at the time this article was written) pales in comparison to other, more high-profile attacks like the one on <a href="https://cryptopotato.com/over-35-million-reportely-stolen-from-atomic-wallet-users/" data-wpel-link="internal">Atomic Wallet</a> users just last week, it also ensures that laundering the profits will not be nearly as hard as it is for cybercriminals who have made off with much bigger takings.</p>
<h2 id="price-manipulation">Price Manipulation</h2>
<p>The attack on Sturdy Finance was carried out via reentrancy exploit, a common method of attacking DeFi projects that entails repeatedly calling a function in a smart contract before the original call is completed.</p>
<p>In order to attack Sturdy Finance, the hacker first established the vulnerability of the protocol’s price oracle – the part of Sturdy’s ecosystem that determines the current value of assets to be used in trading and loans – to reentrancy exploits. Once the vulnerability was established, a flashloan from AAVE provided the liquidity necessary for the attack.</p>
<p>This allows the bad actor to withdraw more funds than the smart contract should allow them to. In this case, the price of staked Ether (stETH) was manipulated three times in a row in order to enable the bad actor to withdraw more than the loan should allow them to, pay off the original loan, and cash out the extra funds. This process was then repeated on five occasions, each time using a different smart contract.</p>
<blockquote class="twitter-tweet">
<p dir="ltr" lang="en">2/ The attack tx (<a href="https://t.co/XdAhTpE6aS" data-wpel-link="external" target="_blank">https://t.co/XdAhTpE6aS</a>) consists of the following attack steps. <a href="https://t.co/EvZhYpWPDO" data-wpel-link="external" target="_blank">pic.twitter.com/EvZhYpWPDO</a></p>
<p>— BlockSec (@BlockSecTeam) <a href="https://twitter.com/BlockSecTeam/status/1668096874816106496?ref_src=twsrc%5Etfw" data-wpel-link="external" target="_blank">June 12, 2023</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>The exploit resulted in a loss of 442 ETH for Sturdy, a takeaway already on its way to Tornado Cash.</p>
<h2 id="post-mortem-in-progress">Post-Mortem in Progress</h2>
<p>The security team at Sturdy confirmed that the exploit has been noted, and their operations have been paused for the moment to conduct a proper post-mortem. The team also <a href="https://twitter.com/SturdyFinance/status/1668080627030315009" data-wpel-link="external" target="_blank">asserted</a> that no other funds are currently at risk of being stolen.</p>
<blockquote><p>“We are aware of the reported exploit of the Sturdy protocol. All markets have been paused; no additional funds are at risk, and no user actions are required at this time. We will be sharing more information as soon as we have it.”</p></blockquote>
<p>Sturdy’s community is understandably upset at the news, with some users proclaiming disbelief that attacks typical of the 2017 shitcoin boom era are still happening today.</p>
<p>The post <a href="https://cryptopotato.com/defi-protocol-sturdy-finance-exploited-for-442-eth-worth-almost-800k/" rel="nofollow">DeFi Protocol Sturdy Finance Exploited for 442 ETH Worth Almost $800K</a> appeared first on <a href="https://cryptopotato.com/" rel="nofollow">CryptoPotato</a>.</p>

DeFi Protocol Sturdy Finance Exploited for 442 ETH Worth Almost $800K

目录

CryptoPotato_News

发布于 2023年6月12日的其他文章

EOS Network Foundation's Resilience: Revitalizing the EOS Blockchain Community

JP Morgan highlights the urgency of regulation to conserve the Crypto industry in US

Andreessen Horowitz Expands Internationally, Setting Up Office in Crypto-Friendly UK

Coinbase places its trust on US court and Congress in the ongoing case; rejects SEC claims

Ripple CTO Wants Community Input on His 'Funny' Address to Metaco Staffers

a16z’s London Expansion: Is the UK Set to Become the Next Crypto Hub?

订阅我们免费的电子期刊，获取每日最新加密领域动态！