BTC $78,720.89 +1.37%
ETH $2,466.37 +1.30%
BNB $697.06 +1.29%
XRP $1.40 +0.92%
SOL $106.35 +2.52%
TRX $0.3406 +0.65%
DOGE $0.0853 +0.60%
ADA $0.2030 +1.47%
BCH $251.62 +2.67%
LINK $11.49 +1.51%
HYPE $83.65 +2.64%
AAVE $126.12 +3.05%
SUI $0.7458 +1.23%
XLM $0.1807 +1.82%
ZEC $846.11 +4.22%
BTC $78,720.89 +1.37%
ETH $2,466.37 +1.30%
BNB $697.06 +1.29%
XRP $1.40 +0.92%
SOL $106.35 +2.52%
TRX $0.3406 +0.65%
DOGE $0.0853 +0.60%
ADA $0.2030 +1.47%
BCH $251.62 +2.67%
LINK $11.49 +1.51%
HYPE $83.65 +2.64%
AAVE $126.12 +3.05%
SUI $0.7458 +1.23%
XLM $0.1807 +1.82%
ZEC $846.11 +4.22%

mantra

Mantra is a decentralized finance (DeFi) platform focused on providing users with staking, lending, and governance features. The platform is built on the Ethereum blockchain and plans to expand to other blockchain networks. Mantra empowers holders with the right to participate in platform governance through its native token OM. The platform is designed to provide users with efficient yield generation and risk management tools, supporting staking and lending operations for various crypto assets.
All
Article
Flash

first_img Cosmos Labs admits to misjudging a vulnerability, resulting in an attack on six chains with a loss of 5.7 million dollars

Cosmos Labs released a technical report, admitting that it previously misjudged an integer underflow vulnerability in the Cosmos EVM, which led to attacks on six blockchain networks between August 20 and 25, resulting in a total theft of approximately $5.7 million in tokens. The attacker exploited the vulnerability to underflow account balances to the maximum value of 2^256-1, then performed a reverse operation to transfer the inflated balance out, thereby stealing tokens from the target accounts without creating tokens out of thin air.The report shows that researchers submitted the defect through a bug bounty program on April 25, but testers were unable to reproduce it on the existing Cosmos chain configuration, so Cosmos Labs silently patched it in May. Independent researchers confirmed in early August that the vulnerability affected all Cosmos EVM chains, and Cosmos Labs released a patch on August 19, but the first attack occurred about 20 hours later.In terms of specific losses, MANTRA lost 720.9 million tokens (approximately $3.6 million), TAC lost nearly 3 billion TAC, and KiiChain lost about 148 million KII. Both MANTRA and KiiChain criticized Cosmos Labs for not notifying the affected chains in advance and suggesting a shutdown, with KiiChain stating that the patch would take several days to deploy while a shutdown would only take a few minutes. Cosmos Labs stated that it has coordinated responses with 40 chains and assisted 13 chains in completing repairs or shutdowns before being attacked.

MANTRA announces the review of the attack incident: A down-scaling vulnerability led to the transfer of over 720 million tokens, with approximately 37.96 million tokens frozen

On August 20, MANTRA Chain released a complete review report of the security incident, confirming that the attacker exploited an unsigned integer underflow vulnerability in the balance accounting layer of the upstream dependency cosmos/evm, unauthorizedly transferring a total of 720,923,967.99 MANTRA from two addresses, valued at approximately 3.6 million dollars based on the price before the attack. Among them, the attacker transferred 600,000,035.56 MANTRA from the on-chain burn address and 120,923,932.44 MANTRA from a genesis-era multi-signature address related to an early incentive program.MANTRA stated that this incident did not involve the leakage of validator keys, administrator privileges, governance control, or multi-signature signers; the attacker did not require privileged access and could complete the attack solely through unauthorized contract deployment and self-funded wallets. The first abnormal transfer occurred at 19:06 UTC on August 20, when the attacker transferred approximately 600 million MANTRA from the burn address; subsequently, at 22:59 UTC, another transfer of approximately 120.9 million MANTRA was made. The chain subsequently stopped operating at 23:13 UTC and resumed after upgrading to v8.4.0. The entire network interruption lasted for 30 hours and 13 minutes.This vulnerability was not an issue with MANTRA's self-developed code but originated from the cosmos/evm module, which is responsible for providing EVM functionality on the Cosmos SDK. The vulnerability allowed the attacker to execute unsigned balance deductions without checking if the balance was sufficient, causing an overflow of values and bypassing normal account authorization logic. MANTRA stated that as of today, no funds have been recovered, with approximately 37.96 million MANTRA (accounting for 5.27% of the total transferred) still remaining in the attacker's address, which has been frozen due to the chain's suspension and v8.4.0 restrictions. The remaining funds have flowed to related trading platforms, and the recovery efforts have entered the law enforcement investigation stage. In the future, monitoring of accounts that cannot normally authorize transfers, burn addresses, and other historically "non-transferable" addresses will be strengthened, and efforts will be made to promote improvements in the security vulnerability disclosure process within the Cosmos ecosystem.

Next week's news insights: The U.S. will release December CPI data

According to the RootData calendar page, next week includes several important news items such as project dynamics, macroeconomic finance, token unlocks, incentive activities, and presale events. Details are as follows:January 12:Zama announces that the Dutch auction-style public sale of tokens will start on January 12;RAIN unlocks 3,705,542.92 tokens, valued at $31,216.94, accounting for 10.908% of the circulating supply;APT unlocks 1,093.5 tokens, valued at $1,979.24, accounting for 1.451% of the circulating supply.January 13:Fogo launches its mainnet;Fogo plans to release tokens on 2026-01-13 00:00:00;Recall airdrop token claim stops;U.S. 10-year Treasury auction results as of January 12 - winning yield;U.S. December unadjusted core CPI year-on-year;U.S. December seasonally adjusted core CPI month-on-month;U.S. December seasonally adjusted CPI month-on-month;U.S. December unadjusted CPI year-on-year;FOMC permanent voting member and New York Fed President Williams gives a speech.January 14:BNB Chain will perform a Fermi hard fork on the BSC mainnet at 02:30 UTC on January 14, 2026;PUFFER unlocks 1,916.67 tokens, valued at $110.39, accounting for 5.515% of the circulating supply;U.S. November PPI month-on-month;U.S. November PPI year-on-year;2026 FOMC voting member and Philadelphia Fed President Harker gives a speech on economic outlook.January 15:MANTRA will discontinue all ERC20 $OM on January 15;DBR unlocks 66,833.33 tokens, valued at $1,258.19, accounting for 16.288% of the circulating supply;Renzo will conduct its third monthly token burn on January 5;Ravencoin's next block reward halving is scheduled for January 15, 2026;CYBER unlocks 736,100 tokens, valued at $562,000, accounting for 1.33% of the circulating supply;2026 FOMC voting member and Minneapolis Fed President Kashkari gives a speech.January 16:ARB unlocks 12,352.78 tokens, valued at $2,583.79, accounting for 2.158% of the circulating supply;VANA unlocks 256.51 tokens, valued at $607.92, accounting for 8.307% of the circulating supply.January 17:ZK unlocks 17,314.47 tokens, valued at $599.18, accounting for 2.016% of the circulating supply;Federal Reserve Vice Chair Jefferson gives a speech.January 18:ONDO unlocks 193,942 tokens, valued at $77,425.14, accounting for 61.345% of the circulating supply;QAI unlocks 250,000 tokens, valued at $1,773, accounting for 31.102% of the circulating supply;Additionally, there is a button at the top of the RootData calendar page for generating image shares, allowing users to select important events for sharing.Risk Warning: This calendar does not constitute any investment advice.
app_icon
ChainCatcher Building the Web3 world with innovations.