极光

Security Researcher // 世界既不黑也不白，而是一抹精致的灰

[Matt @matthubuilds]

Seamless crypto off-ramp with a 100% compliant Swiss bank account — zero card fees, 1% top-up, instant Mastercard virtual debit, and global spending via PayPal, Apple Pay, Google Pay & more. Powered by BloFin.

[Matt @matthubuilds]

Introducing the BloFin Master Debit Card — your crypto, finally usable anywhere Mastercard is accepted.

[极光 @jiguangsdf]

@xuxiaopengmint mint的播客和文章都有经常看，从一个行业开发技术的角度，受益颇深，先不论对与错，任何分析都架不住市场的千变万化，敢于站出来说的人起码是有自己的主观思考在，在这个浮躁的市场中，静下心来客观分析已经难能可贵，市场的支持与反对都是一种积极的反馈，为了之后做得更好

[极光 @jiguangsdf]

@0xHammermann @aave nice

[极光 @jiguangsdf]

@binenetxyz @RDNTCapital 0xA950974f64aA33f27F6C5e017eEE93BF7588ED07 Ethereum
0x30798cFe2CCa822321ceed7e6085e633aAbC492F Base

[极光 @jiguangsdf]

看起来又是一个私钥泄漏的案例

[Binenet @binenetxyz]

🚨#Web3ThreatIntelligence🚨
Through our analysis of suspicious transactions in the @Vowcurrency protocol (see the previous tweet for details), it is suspected that the private key of the usdRateSetter (0xbA1be907) of VOW Token has been leaked. Before and after the attacker executed the transaction, the address changed the value of the usdRate parameter[p1].
The attacker used the modified USDRate to mint a large amount of $vUSD (1,486,625,529) in exchange for more
$VOW (59,507,425) profits, the specific attack process is as follows[p2]:

1. From Uniswap V2: VOW Lightning Loan 1,486,625 $VOW
2. Transfer 1,486,625 $VOW to VSCTokenManager
3. Execute burn to destroy 1,486,625 $VOW in the internal function tokenReceived of VSCTokenManager
4. Check that Vow: VOW Token. usdRate (1) returns 100. The key step is that through our analysis, the usdRateSetter (0xbA1be907) address maliciously updated the usdRate exchange rate to 100 in previous transactions, resulting in the minting of a large amount of vUSD
5. Use the exchange rate difference to mint 1,486,625,529 vUSD and then exchange it for 59,507,425 $VOW
6. Repay Uniswap V2: VOW Lightning Loan of 1,491,098 $VOW
7. Exchange 26,107,347 $VOW for 175 $ETH
8. Use 26,107,347 $VOW to exchange for 595,970 $USDT
9. Wallet balance of 5,801,632 $VOW

[极光 @jiguangsdf]

我在2020的写过类似的文章，现在看，时间越长，这些攻击方式似乎大家又忘记了，之前的攻击方式又出来了，web3卧龙藏虎的地方
https://t.co/ExouTsUlkK

[YCheng⠕ @YCheng_Ho]

#Web3
在币圈被诈骗的经历，让我深刻体会到一句话：「你永远无法赚到超出你认知范围之外的钱。」以下是我的反思和总结，希望能为自己和他人提供一些警示。

今天是在币圈被骗的第二次，反思了很久，总结几点就是贪婪、冲动、缺乏思考、缺乏验证。

[极光 @jiguangsdf]

@YCheng_Ho 我在2020的写过类似的文章，现在看，时间越长，这些攻击方式似乎大家又忘记了，之前的攻击方式又出来了，web3卧龙藏虎的地方

https://t.co/ExouTsUlkK

[极光 @jiguangsdf]

@richard51898937 @xuxiaopengmint 水印不是有吗

[Binenet @binenetxyz]

Our analysis reveals that the depositToGasZipERC20 function of the GasZipFacet contract in LiFiDiamond did not validate the LibSwap.SwapData parameter, leading to the attack. The call chain indicates that the attacker ultimately accessed the swap function within the LibSwap library. This function failed to verify the callTo parameter in _swap.callTo.call, enabling the attacker to invoke the transferFrom of the stablecoin contract and transfer assets from authorized users. Notably, the attacker had pre-deployed multiple contracts to circumvent the parameter checks within the swap function, allowing all functions in the attack chain to execute as intended.

We reiterate the importance of conducting comprehensive code security audits and regression testing for DeFi contract code before formal deployment on the blockchain. This ensures that all business logic is correctly implemented and that parameters are strictly verified to prevent such vulnerabilities.

https://t.co/btjI4ZkEaS

[极光 @jiguangsdf]

还挺多的保持警惕

[Binenet @binenetxyz]

Based on community intelligence, several domains of crypto projects registered with Squarespace are at risk. This is a list of all domains registered with this registrar, which may also be at risk of being hacked. Exercise caution when interacting with domains on this list until an official statement is made.

https://t.co/u9Q35WNH4T

[Binenet @binenetxyz]

As always, stay careful
https://t.co/HonHoiXsT2

[极光 @jiguangsdf]

这个从开发者角度也是无赖之举，很多DApp网站默认支持window.ethereum注入provider，这也是之前metamask的注入方案，意味着后来的钱包插件需要在页面运行时注入替换这个window对象为自家钱包，或者自己注入一个新的window对象，如window.okxweb3，可问题是得DApp本身支持，这也是metamask网络效应的原因，默认代表是它的provider。后来的EIP-6963支持多插件钱包检测，但DApp支持这样检测的很少

[极光 @jiguangsdf]

@ai_9684xtpa @renzoai 这个合约钱包本身有execTransaction函数是可以操作ezETH的，再则即使这个合约没法操作，但因为ezETH合约本身也是可以升级的，联系项目就可以处理了，不存在无法转出

[极光 @jiguangsdf]

@ethena @bitgetglobal doit!

[极光 @jiguangsdf]

@Yukin_btc @punk2898 可以使用，移除后对方会断开，操作需要重新登陆，建议1移除所有设备会话 2立即修改密码 3添加登陆两步认证，不要加提示，以免泄漏信息被猜测 ，把密码等保存在其他安全的地方如1password 4设置恢复邮箱并为邮箱开启ga验证，强制登陆需要验证码

[极光 @jiguangsdf]

@pudgypenguins just wait. lol

[Binenet @binenetxyz]

YOLO Games @YOLO_Blast suffered a theft of $1.5 million due to the lack of permission checks in the 'exitPool' function.

https://t.co/dliC45ZuU7

[极光 @jiguangsdf]

@GracyBitget @bitgetglobal 恭喜🎉

[极光 @jiguangsdf]

@YOYO_uu9 @CryptoUKong @cellulalifegame @biteyinli 说明很棒哈哈