EVM Hacks @evmhacks Channel on Telegram

EVM Hacks

20 Nov, 09:47

https://blog.decurity.io/current-state-of-web3-security-products-202de56b68bf

EVM Hacks

18 Nov, 15:11

On November 14, several Uniswap pairs with the vETH token were exploited due to a price manipulation vulnerability in the vETH liquidity addition contract. The total amount lost was 140.4 ETH (~$450,000).
The attack was executed in three transactions:

1. Attack on the BIF-vETH pair at 08:35:47, 132.5 ETH stolen.
2. Attack on the Cowbo-vETH pair at 08:36:59, 4.84 ETH stolen.
3. Attack on the BOVIN-vETH pair at 08:39:23, 3.12 ETH stolen.

I was unable to identify the name of the exploited protocol, its landing page, or its Twitter profile. However, the owner of the vETH token is GnosisSafeProxy, whose creator and owner is shaneson.eth.

Attack steps(pic. 1):
Steps 1-2: The exploit got flashloan 32,560 ETH from Balancer and called buyQuote() on an unverified contract 0x19c55. This function wrap ETH->vETH in vETH contract via the cashIn() function(pic. 2) and swapped vETH for a specified token through a Uniswap pair. As a result, the BIF/vETH price in pool increased. Only whitelisted addresses (contract 0x19c55 in whitelist) can call the cashIn() function.
Step 3: Exploit approved BIF tokens on an unverified contract 0x62f25 and called a function with the 0x6c0472da signature. This function added liquidity to the vETH-BIF pair, transfers only BIF tokens from exploit contract. The required amount of BIF was calculated using UniswapV2Library.quote() (pic. 3), which accounted for the current reserves in the pool. vETH tokens were minted to Uniswap pair using the takeLoan() function in the vETH contract. The 0x62f25 contract, with validFactory permissions, was able to call takeLoan(). By exploiting price manipulation, the attacker added 300 vETH to the pool for a minimal amount of BIF.
Step 4: The attacker called sellQuote() in 0x19c55, swapping BIF for vETH and unwrapping vETH into ETH. Due to the addition of "cheap" liquidity, the attacker profited 132.5 ETH.
Step 5: Flashloan was repaid, and the stolen ETH was transferred to the attacker’s address.

Contract containing the vulnerability was deployed on October 27. The BIF-vETH pair was created, and liquidity was added on November 11.

Recently, unverified contracts are being exploited more frequently. Unverified smart contracts are not a guarantee of reliability; they also require audits. Blackhats are willing to do anything for easy money.

316

EVM Hacks

29 Oct, 09:19

Use this list of fantastic telegram channels I've put together in order to discover them as your own personal Web3-Google!

Feel free to use this folder to onboard your non-web3 friends to Web3, as the majority of the channels are maintained by independent researchers. There are also additional channels for news, CT reviews, and more!

A small tip to subscribooors: if you find a channel interesting, move it out of the folder into your main list of chats. That way you’ll view content you’re interested in more often, and channels get more views instead of just subscribers!

172

EVM Hacks

26 Sep, 20:17

root cause of the bedrock uniBTC hack: mint() function transfer uniBTC to user in amount of ETH received...
upgrade proxy was 34 hours before hack.
649 ETH stolen

2,958