MetaSec

Web3 Security Research (telegram:

[MetaSec @MetaSec_xyz]

@TradeOnOrion Additionally, the lack of update liabilities for a user when releasing assets is a key factor contributing to this attack.

[MetaSec @MetaSec_xyz]

Since @TradeOnOrion has upgraded their vulnerable contract, we can provide a detailed explanation of this exploit now. The root cause is the liabilities for a user in not correctly updated when remove liability for this user. https://t.co/qYMtjd89rx

[MetaSec @MetaSec_xyz]

@TradeOnOrion The root cause of the issue lies in the inadequate handling logic of the removeLiability when updating the user's liabilities.

[MetaSec @MetaSec_xyz]

This analysis did not touch the essence of the exploit. The root cause is that xBank team made incorrect modifications to the Compound code.

[xBank Finance 🏦 @xBank_Finance]

The attacked conducted a Precision Loss Attack on @xBank_Finance

You can find the post-mortem analysis of the exploit in the article below:
https://t.co/r36UGjkNcx

Thank you for your patience & understanding.

[MetaSec @MetaSec_xyz]

@MIM_Spell Although the round up handling in the _repay() function follows the ERC4626 standard, the exploiter actually took advantage of this to profit due to the existence of the replayForAll() function.

[MetaSec @MetaSec_xyz]

Our analysis show that the exploit on @MIM_Spell is due to rounding issue and the total loss is ~$6.5M.
https://t.co/eZ4ooy7p9V

[MetaSec @MetaSec_xyz]

The unverified contract 0x82c063afefb226859abd427ae40167cb77174b68 has a vulnerability that anyone can call the redeem() function to burn the $BUI tokens held by this contract and get the corresponding underlying assets.
https://t.co/CvdAmss9kS

[MetaSec @MetaSec_xyz]

JFIN: 0xFCb9686F9e07A492Db39D799B19ba84f870102D3
MANTLE: 0xBeaDcB195D73C1EB3a8B1672f76392574A7D7B72

[MetaSec @MetaSec_xyz]

Alert! @_LiquidCrypto was hacked on multiply chains.

Revoke your approvals as early as possible. And we will share the root cause when users funds are safe.

https://t.co/E9cLPb6lZB

[MetaSec @MetaSec_xyz]

Contracts list:
BSC: 0x7aF28f224CF764e308463eDe2c34276d082092d4
AVAX: 0xf6b9EaFfBc8aC294102f93A661E3075C721f7a6a
ETH: 0x364f17A23AE4350319b7491224d10dF5796190bC
ONUS: 0xC4469C21F3BD37dFfA1051B1397858AFF80D7A44

[MetaSec @MetaSec_xyz]

One more exploit tx with the profit of ~$289k.
https://t.co/BNUa3p8ix5

https://t.co/p0TCeFdRcU

[MetaSec @MetaSec_xyz]

Another rounding issue exploit for Compound V2 fork protocol. Please do something @ChannelsFinance.
https://t.co/SRnTV11LVB

[MetaSec @MetaSec_xyz]

🚨🚨🚨The #MIC token has a vulnerability that allows the LP holder to claim LP fees repeatly. One exploit tx: https://t.co/M9z0INMawJ

[MetaSec @MetaSec_xyz]

@RDNTCapital was hacked by the notorious rounding issue on the empty rUSDCn market. It's always suggested to do a guard launch for the new market.

https://t.co/iPgetkLdyu

[MetaSec @MetaSec_xyz]

@RDNTCapital was hacked by the notorious rounding issue on the empty rUSDCn market. It's always suggested to do a guard launch for the new market.

https://t.co/iPgetkLdyu

[MetaSec @MetaSec_xyz]

Another rounding issue exploit for Compound V2 fork protocol. Please do something @ChannelsFinance.
https://t.co/SRnTV11LVB

[MetaSec @MetaSec_xyz]

Admin change:
https://t.co/RoTHBp1LsK
Malicious upgrade:
https://t.co/5DbT9wbAet
TX:
https://t.co/aiyuzceztF

[MetaSec @MetaSec_xyz]

🚨🚨🚨Compromised Key? Malicious upgrade on BUSDPosiVaultV2 of @PositionEx allows the hacker to steal user assets assigning approval to BUSDPosiVaultV2, leading to the gain of ~$280K for the hacker.
Please revoke you r approvals to 0xf35848441017917a034589bfbec4b3783bb39cb2.