遭遇攻击

Syscoin posted on platform X to provide the community with a preliminary update regarding the recent cross-chain bridge security incident involving 5 billion SYS tokens. The bridging service has been suspended, and the team is investigating and fixing the validation issues. The attacker exploited a validation vulnerability in the cross-chain bridge process to create unauthorized SYS outputs on the UTXO side.The affected funds have been transferred and split, and the team is tracking and coordinating with exchanges and ecosystem partners to prevent the contaminated UTXOs from being deposited, traded, or further distributed. The team has identified a fix and advises users not to interact with the cross-chain bridge until it is restored.

According to BlockSec monitoring, the DBXen contract was attacked this morning, with estimated losses of about $150,000. The root cause lies in the inconsistency of the sender's identity under the ERC2771 meta-transaction. In the burnBatch() function, the gasWrapper() modifier uses _msgSender() (the actual user) to update the state, while the callback function onTokenBurned() uses msg.sender (the relayer). This leads to accCycleBatchesBurned being recorded for the user, but lastActiveCycle being incorrectly updated for the relayer.This inconsistency disrupts the logic of claimFees() and claimRewards(). When updateStats() is run for the user, the contract incorrectly assumes there are unprocessed burned batches because accCycleBatchesBurned has been updated while lastActiveCycle has not, resulting in incorrect calculations of rewards and fees, allowing the attacker to extract excess funds for profit.

Fusion Releases Security Update: The IPOR USDC Fusion Optimizer has a vulnerability in the Arbitrum Vault. The IPOR team has been notified of a vulnerability that resulted in a loss of $336,000 USDC.The vulnerability targets a specific outdated Fusion Vault. Due to its unique configuration, this is the only vault that is susceptible to this particular attack vector. The loss accounts for less than 1% of the total funds guaranteed by Fusion. They are working with the Security Alliance to track and recover the funds. The IPOR DAO will cover the funding gap from the treasury. All affected depositors will be fully compensated.

ChainCatcher news, according to monitoring by Shield, CrediX suffered a security vulnerability attack today, with hackers exploiting a compromised administrator account that had multiple management privileges. This account had the following permissions: POOL_ADMIN (Fund Pool Administrator), BRIDGE (Cross-Chain Bridge Permissions), ASSET_LISTING_ADMIN (Asset Listing Administrator), EMERGENCY_ADMIN (Emergency Administrator), RISK_ADMIN (Risk Control Administrator), etc.The attackers utilized the BRIDGE permission to steal or borrow assets from the fund pool, with estimated losses of around 4.5 million dollars. This also included the minting of counterfeit (unsupported by real assets) acUSDC tokens (Credix Market Sonic USDC).Previous report indicates that CrediX has disabled its website and prohibited user deposits; users who need to perform operations should withdraw through the contract.

ChainCatcher news, according to monitoring by PieShield, the NFT market SuperRare has been attacked, resulting in a loss of approximately $730,000 worth of RARE tokens.