攻击

According to BlockSec monitoring, the DBXen contract was attacked this morning, with estimated losses of about $150,000. The root cause lies in the inconsistency of the sender's identity under the ERC2771 meta-transaction. In the burnBatch() function, the gasWrapper() modifier uses _msgSender() (the actual user) to update the state, while the callback function onTokenBurned() uses msg.sender (the relayer). This leads to accCycleBatchesBurned being recorded for the user, but lastActiveCycle being incorrectly updated for the relayer.This inconsistency disrupts the logic of claimFees() and claimRewards(). When updateStats() is run for the user, the contract incorrectly assumes there are unprocessed burned batches because accCycleBatchesBurned has been updated while lastActiveCycle has not, resulting in incorrect calculations of rewards and fees, allowing the attacker to extract excess funds for profit.

Fusion Releases Security Update: The IPOR USDC Fusion Optimizer has a vulnerability in the Arbitrum Vault. The IPOR team has been notified of a vulnerability that resulted in a loss of $336,000 USDC.The vulnerability targets a specific outdated Fusion Vault. Due to its unique configuration, this is the only vault that is susceptible to this particular attack vector. The loss accounts for less than 1% of the total funds guaranteed by Fusion. They are working with the Security Alliance to track and recover the funds. The IPOR DAO will cover the funding gap from the treasury. All affected depositors will be fully compensated.

ChainCatcher news, according to monitoring by Shield, CrediX suffered a security vulnerability attack today, with hackers exploiting a compromised administrator account that had multiple management privileges. This account had the following permissions: POOL_ADMIN (Fund Pool Administrator), BRIDGE (Cross-Chain Bridge Permissions), ASSET_LISTING_ADMIN (Asset Listing Administrator), EMERGENCY_ADMIN (Emergency Administrator), RISK_ADMIN (Risk Control Administrator), etc.The attackers utilized the BRIDGE permission to steal or borrow assets from the fund pool, with estimated losses of around 4.5 million dollars. This also included the minting of counterfeit (unsupported by real assets) acUSDC tokens (Credix Market Sonic USDC).Previous report indicates that CrediX has disabled its website and prohibited user deposits; users who need to perform operations should withdraw through the contract.

ChainCatcher news, according to monitoring by PieShield, the NFT market SuperRare has been attacked, resulting in a loss of approximately $730,000 worth of RARE tokens.

ChainCatcher news, according to CertiK Alert monitoring, Slurpycoin on BSC has suffered a flash loan attack, where the attacker manipulated the token price using a buyback mechanism and profited approximately $3,000 from sandwich arbitrage.

ChainCatcher message, according to Beosin Alert monitoring, Gearbox Protocol was attacked by a flash loan on the Ethereum network, resulting in a loss of approximately 400,000 USD.

ChainCatcher news, according to PeckShield monitoring data, the on-chain collateral protocol Arcadia Finance has been attacked on the Ethereum and Optimism networks, resulting in a loss of approximately $455,000. The attacker has transferred 179.3 ETH to Tornado Cash mixer.According to PeckShield's analysis, the attack was due to a lack of validation for untrusted inputs, which the attacker exploited to transfer funds from the darcWETH and darcUSDC vaults. Specifically, the attacker took advantage of a vulnerability in the ArcadiaFi project that allowed unverified input data to be accepted and executed malicious operations. (source link)