Dani | Web3 Sec 🛡

Passionate about Web3 & Blockchain Security | Smart Contract Auditor | Get your code secured 🛡️ 👉🏽 DM for private audit

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@Phalcon_xyz @Penpiexyz_io How can we still miss a reentrancy vulnerability in 2024? 🤦🏻‍♂️

[BlockSec Phalcon @Phalcon_xyz]

A few hours ago, Penpie @Penpiexyz_io , a farming protocol built on the Pendle Protocol, suffered a reentrancy attack resulting in a loss of ~$27M. Since Penpie has been paused, we are now providing a detailed root cause analysis.

This is a typical issue due to the lack of reentrancy guard. Specifically, the vulnerable contract (0xff51c6, the implementation contract of PendleStaking) fails to consider that the provided argument, i.e., markets, might be untrusted, which can abused to reenter into this contract.

Attack preparation TX: https://t.co/GfqcLFioiO
The attacker initially created a counterfeit SY (standardized yield token, i.e., 0x4476b). Although the SY tokens themselves were worthless, the contract was set up with two high-value PENDLE-LPT market tokens (i.e., 0x6010_PENDLE-LPT, 0x038c_PENDLE-LPT) as the reward tokens. By doing so, the attacker then created a market on Pendle and registered it on Penpie.

Attack TX: https://t.co/tyI6SmL5Ao
During the attack, the attacker executed the batchHarvestMarketRewards() function to harvest rewards, which were calculated based on the difference in balanceOf() before and after the redeemRewards() function was invoked. The redeemRewards() function, in turn, triggered the claimRewards() function of the specific market. As the protocol did not anticipate the possibility of a market being maliciously controlled, the attacker was able to re-enter the victim contract through the depositMarket() function.

After that, the attacker deposited the two high-value LPT market tokens, which were mistakenly treated as rewards. Simultaneously, the attacker received minted shares corresponding to these deposits. Consequently, the attacker could withdraw the same valuable LPT market tokens along with the corresponding shares minted in depositMarket(), and claim the reward to realize a profit.

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

📜TX:
0x76a4a8467b6d27b9460b304b2624fadf4684a96fa7badb2253e291fbf6606b5d

💸Victim:
0xba1809Ab216562442B4F798D9DE0Be5452D60D49

👹Malicious smartcontract:
0x0000db5c8B030ae20308ac975898E09741e70000

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 Again another victim lost $72,857 (28.89 $stETH) 10 minutes ago, due to a malicious smart contract interaction. 🤦🏻‍♂️

📩I've reached out to the victim via an on-chain message for more details on the incident and am currently monitoring the movements of the scammer...🔎

More details soon...👇🏻

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

📜TX:
0xfe1ebf81870a7799ff557e3f623198ae1a3c6fbd18f793d6d04fe236d2ab017e

💸Victim:
0x0D15c865c537683D797996EDdb5eF28e974B6F70

👹 Malicious Smart Contract:
0x0000db5c8B030ae20308ac975898E09741e70000

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 Alert: A user lost $809,851 (321 $stETH) just 2 hours ago due to a malicious smart contract interaction.

📩I've reached out to the victim via an on-chain message for more details on the incident and am currently monitoring the movements of the scammer...🔎

Stay tuned for further updates...👇🏻

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@_nikolajankovic Google Ads can't auto-detect cloaking. For faster action, report the ad for trademark issues and urge @defisaver to report it too. Human review is needed.

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 ATTENTION WEB3 USERS! 🚨

Beware of fake dApp websites! Scammers are still using Google Ads to trick you.
Example: Searching "defisaver" on Google?
The top ad might lead you to "defissaver .com" - a scam site with Inferno drainer! 🔍

Always double-check URLs & never sign transactions hastily. Stay safe out there! 🔒
#Web3Security

*BTW @DeFiSaver you should do something about it!

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

*1,000,000 $PIXL tokens

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 1 hour ago (sealgoodman.eth) lost $26,067 (1000 $PIXL) by interacting with a malicious smart contract.

I’ve sent an on-chain message to the victim to understand what happened and am tracking the crypto scammer...🔎

More details below...👇🏻

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

📜TX:
0x1381e7c8ce7b424d4d014cb444facfac8e5063ce086954b28d03ce38d0daaff5

💸Victim:
0x439901eCaB06F75B14bC25fD60d53bB3A3b9e277

👹 Malicious Smart Contract:
0x0000db5c8B030ae20308ac975898E09741e70000

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

📜TX:
0xd74c5e58f6375c124fd7c8a4aa0383c78920a735b0e71351c6b9ba75ccddd8a1

💸Victim:
0x9453e7b8E0C83943938D40BA74117D1ae6a2bAe0

👹 Malicious Smart Contract:
0x000095c13a0354b7131769b6312F344930eb0000

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 Someone just lost 3.69 $ETH ($9,219.56) by interacting with a fake claim function in a malicious smart contract.

I’ve sent an on-chain message to the victim to understand what happened and am tracking the scammers...🔎

More details below...👇🏻

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 Just uncovered a smart contract that’s been siphoning multiple approvals through interactions with wallets. Some of these wallets hold massive fortunes that could be at risk of being drained. 🕵️‍♂️

⚠️ Users, be extremely cautious and make sure to revoke any unnecessary approvals immediately!

Stay safe out there. More details soon...

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@Casey73271295 What do you mean?

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

🚨 1 hour ago someone lost $180,198 (67 $stETH) by interacting with a malicious smart contract.

I’ve sent an on-chain message to the victim to understand what happened and am tracking the crypto scammer...🔎

More details below...👇🏻

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@Cointelegraph Hodl is the best think to do.💎

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@CryptoOnlyCoims I've never seen this type of scam before, is this new?

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@realScamSniffer Everyday .... that's so crazy! 😪

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

@mochivault_eth Often, they don't even realize they've given an approval...😥

[Dani | Web3 Sec 🛡 @DaniWeb3Sec]

📜TX:
0xefdb08b6f25e18865cbc50372f0299fa4bf24156db1e7272e49c8ab189bf7ccb

💸 Victim:
0xc4239f64c1A4607fE5145a5b7F9945A592f2bF6F

👹 Malicious Smart Contract:
0xed0e416e0fEEA5b484ba5c95d375545AC2b60572