Cyba Blockchain Security

Rigorous smart contract and protocol security across EVM and Bitcoin L2 ecosystem @Stacks (Clarity)

[Cyba Blockchain Security @CybaSecurity]

https://t.co/CAPoFWUIY7

[Cyba Blockchain Security @CybaSecurity]

Announcement of an announcement:

We'll soon, quite soon, publish our most comprehensive open-source contribution to the @Stacks ecosystem yet.

Stay tuned!

[Cyba Blockchain Security @CybaSecurity]

More on these, with PoCs you can hand to your devs or agents to adapt to your codebase:

Third-party MakerDAO ETH-A liquidation keeper
https://t.co/sH00JLbmye
https://t.co/e0DetC0tmO

Third-party FlashLoopAdapter Safe module
https://t.co/OsN5rVXiah
https://t.co/03MBwY5rgn

GoldPesa
https://t.co/tdmLhwxZvG
https://t.co/TQPpSJFnPL

Set Protocol
https://t.co/94qcBzCWgi
https://t.co/lawH2x3Uzs

Credits to @DefimonAlerts and @SlowMist_Team for the initial analysis, and @DeFiHackLabs for the PoCs.

[SlowMist @SlowMist_Team]

🚨SlowMist TI Alert🚨

💸 @aave v3 Loop Safe Module Loss: ~114.09 ETH

🔍 Root Cause: FlashLoopAdapter's open()/close() access control only checks ISafe(msg.sender).isModuleEnabled(address(this)), which is spoofable via a fake Safe that always returns true. Its _swap() then executes https://t.co/chm98OvJ5d with fully attacker-controlled router and calldata. Since the adapter is an enabled module of the victim Safes, the attacker set router=victim Safe and data=execTransactionFromModule to drain weETH and Aave collateral.

📌 Attacker: 0x42c2633438609881c8fBAb82414eb9A0c45F9353
📌 Victim: 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520, 0xcfedf95a3653a128dfc2e4288758a1a1850d169f
📌 Vulnerable Contract: 0x16bb8b912da187870c23ec6756bb3fad061283d8

Impact: ~114.09 ETH stolen from two Safe multisigs via forged Safe authentication and arbitrary module execution; ~1300 WETH debt repaid to unlock collateral.

Powered by https://t.co/Mz5jOnx997
Tx: https://t.co/RcTy5VB9AH

[Cyba Blockchain Security @CybaSecurity]

Last week in web3 security we saw several exploits. Two of them, plus two from a few days earlier, came down to a check nobody made.

Here is where each one broke and what we'd change:

🔹 Third-party MakerDAO ETH-A liquidation keeper: $538K loss (on @ethereum)

This third-party keeper, a dormant 2020 proxy, never settled four auctions it had won, and its drain function had no auth, so anyone could take the 200 WETH. The bug was not in MakerDAO core.

The lesson for anyone running a liquidation keeper is to put auth on every function that moves funds, even on a retired bot.

🔹 Third-party FlashLoopAdapter Safe module: $305K loss (on @ethereum)

On Oct 1, this third-party Aave v3 loop module trusted any caller claiming it was enabled, then called a router the caller chose, so a fake Safe drained two real ones.

If you're building a Safe module, you should check callers against Safes you track and never call addresses they supply.

🔹 GoldPesa: $114.9K loss (on @base)

On Oct 2, GoldPesa's own Uniswap v4 hook rebalanced inside the attacker's unlock without checking deltas were settled, so its burn credit paid off the attacker's unpaid mint.

Teams shipping a Uniswap v4 hook should require settled deltas before moving liquidity inside a caller's unlock.

🔹 Set Protocol: $13.7K loss (on @ethereum)

An old v1 contract, still holding collateral after the team deprecated V2 and TokenSets, let anyone call actualizeFee(), which rounded unitShares up with no fee taken, so issuing before and redeeming after paid out extra.

When building a rebalancing DeFi mechanism, make sure to round collateral per share in the protocol's favor.

All of them mentioned hacks were the result of misplaced trust and unbacked assumptions. The protocols never actually checked:
- who was calling
- whether the books were settled
- which way a number rounded

If you're building or running contracts like these, from Safe modules to Uniswap v4 hooks, we at Cyba can review them for you.

More on each hack in the reply below 👇

[Cyba Blockchain Security @CybaSecurity]

@AccountableData It's been a pleasure continuing to work with a team that keeps security close to the development process.

Engagement details & full report ↓
https://t.co/0XnDVmibf2

Also, a new engagement is already underway, marking yet another step in our growing collaboration. More to come!

[Cyba Blockchain Security @CybaSecurity]

We're happy to have once again collaborated with @AccountableData on securing their infrastructure.

For this engagement, we reviewed Accountable's Collateral Fixed-Term Strategy, covering both the implementation itself and its integration with the broader vault infrastructure.

[Cyba Blockchain Security @CybaSecurity]

We've completed our security audit for @AccountableData, reviewing a staking module extension to their DeFi vault infrastructure.

The team's fixes were also verified through a dedicated fuzz testing campaign.

More on the engagement:
https://t.co/JRuoob9atZ

[Cyba Blockchain Security @CybaSecurity]

@GraniteBTC 2/2

A detailed report of the audit can be found here:

https://t.co/KSxkOzJkJs

[Cyba Blockchain Security @CybaSecurity]

1/2

Back with another security review for @GraniteBTC.

This engagement focused on liquidation improvements and protocol hardening, covering changes to liquidation flows, bad debt handling, staking mechanics, and related core functionality.

Granite continues to build Bitcoin-backed liquidity infrastructure on Stacks through sBTC, while iterating on the protocol's security and robustness.

Always a pleasure working with teams that treat security as an ongoing process rather than a checkbox.

[Cyba Blockchain Security @CybaSecurity]

@GraniteBTC @Stacks @trustmachinesco 2/2

A detailed report of the audit can be found here:
https://t.co/TVChIxGi8m

[Cyba Blockchain Security @CybaSecurity]

1/2

We recently completed a security review for @GraniteBTC, a Bitcoin liquidity protocol built on @Stacks enabling users to borrow stablecoins against Bitcoin collateral through sBTC, developed by @trustmachinesco.

This engagement focused on reviewing fixes, hardening efforts, and protocol enhancements across the protocol’s lending system, covering changes across borrowing, liquidation flows, staking, governance, LP incentives, oracle integrations, withdrawal logic and related core functionality.

Granite combines Bitcoin-backed liquidity access with design choices such as isolated collateral, soft liquidations, and Bitcoin-native infrastructure.

Happy to support teams building BTCfi infrastructure. Always a pleasure working with security-oriented teams pushing the ecosystem forward.

[Cyba Blockchain Security @CybaSecurity]

Our founder @abarbatei spoke last week at @ETHCluj about securing BTCfi and how Bitcoin''s expanding ecosystem introduces new security assumptions.

Topics covered:

🟢 Bitcoin security assumptions
🔴 Historical Bitcoin network vulnerabilities (25 disclosed issues in the last 10 years)
⚪ Litecoin April incident analysis
🟡 BitVM technology
🟠 Bitcoin L2s: @Stacks, @citrea_xyz, @babylonlabs_io

Understanding how security assumptions stack is critical for building and securing BTCfi systems.

🔗 Watch the full presentation:
https://t.co/BGTqJhb6Aw

[Cyba Blockchain Security @CybaSecurity]

Happy to be among the Romanian teams featured.

Romania has a strong builder base across Ethereum and blockchain in general, with a lot of solid work happening quietly in the background. It's good to see more visibility on what's being built locally and how the ecosystem is taking shape.

Well worth a read for anyone looking to understand the space better.

https://t.co/8mgYPtbnWc

[Aave @aave]

The rsETH markets on Aave V3 and Aave V4 have been frozen. Aave's contracts have not been exploited and this is an exploit related to rsETH.

The freeze follows an exploit of the Kelp DAO rsETH bridge. Freezing the rsETH markets prevents new deposits and borrowing against rsETH collateral while the situation is assessed.

We are reviewing information about rsETH borrows on Aave that occurred after the exploit and will share more details as soon as possible.

If the protocol accumulates bad debt from this incident, we'll explore paths to offset the deficit.

[Cyba Blockchain Security @CybaSecurity]

2/2

This article breaks down:

- how Stacks addresses are derived and encoded
- why different address formats exist across networks
- what these differences mean from a security perspective

Read:
https://t.co/fk09eETS2N

[Cyba Blockchain Security @CybaSecurity]

1/2

When we launched Cyba in February, we said to judge us by what we publish, how we review code, and the standards we hold ourselves to.

We're continuing on that path by publishing security content that benefits the ecosystem.

We're starting with a deep dive into Stacks principal (address) derivation and standard network checks.

For those who may not know, @Stacks is the leading Bitcoin L2, where we have extensive experience securing protocols.

[Cyba Blockchain Security @CybaSecurity]

@AccountableData While the report for this engagement remains private, you can find one of our previous public audits for Accountable, for reference, here:

https://t.co/x9mde0Padx

[Cyba Blockchain Security @CybaSecurity]

We've completed our security audit for @AccountableData, reviewing an extension to their DeFi credit vault infrastructure.

Accountable is a key player operating at the intersection of DeFi and TradFi.

Their vault-based credit layer programmatically allocates capital across lending strategies, with over $160M deployed to generate risk-adjusted yield.

They are also building the Data Verification Network (DVN), a privacy-preserving infrastructure that verifies financial data directly at the source. It already secures $1B+ in assets across partners like Galaxy, Amber Group, and K3 Capital, positioning Accountable at the intersection of onchain finance and institutional reporting.

Security at this scale is never a one-off.

[Cyba Blockchain Security @CybaSecurity]

Just kicked off a new audit for an extension to a complex DeFi strategy system.

Good protocols don't treat audits as a one-time checkbox. Every production change deserves a security review.

From first contact to audit kickoff: < 24h.

Security doesn't end after the first audit.

[Blockaid @blockaid_]

🚨URGENT: Blockaid's system has identified a front-end attack on compound[.]finance, and is redirecting to a malicious website.

If you’re connected, please refrain from signing transactions and avoid interactions with the dApp until the issue is resolved.