Loophe Lau

Miner and MEV coder 👨‍💻 .

[Loophe Lau @loophe_liu]

Scan all contract addresses and bytecodes cross the chain based on 'celery' ( a message arry triger) https://t.co/qY4kY0p26k

[Nick Percoco @c7five]

We have had a Bug Bounty program in place at Kraken for nearly ten years. This program is run internally and is fully staffed by some of the brightest minds in the community. Our program, like many others, has clear rules of the road…

1. Do not exploit more than you need to in order to prove the vulnerability.
2. Show your work (i.e. provide a proof of concept)
3. What you extract you return immediately

[banteg @banteg]

this is so fire

[MevRefund @MevRefund]

who tf is Daniel Wang?

[sudo rm -rf --no-preserve-root / @pcaversaccio]

PLEASE REVOKE THE FOLLOWING ADDRESSES ASAP:
- Ethereum Mainnet: 0xbc83f2711d0749d7454e4a9d53d8594df0377c05
- Arbitrum Mainnet: 0x2d99e1116e73110b88c468189aa6af8bb4675ec9

[PeckShield Inc. @peckshield]

Hi @MIM_Spell, you may want to take a look (w/ $6.49M Loss)

[Loophe Lau @loophe_liu]

@Phalcon_xyz @BlockSecTeam This is a old issue one year ago?

[Loophe Lau @loophe_liu]

@optimizoor So SOL need reboot frequently?!

[BlockSec Phalcon @Phalcon_xyz]

Since OZ has publicly disclosed the details of the problematic integration between two specific standards – ERC-2771 and Multicall – we now re-share our analysis of the related exploit.

The interesting aspect of this exploit stems from the way the public burn issue was taken advantage of, specifically the inconsistency between the Forwarder.execute() function and the TokenERC20.multicall() function. Notably, the attacker persistently targeted tokens vulnerable to this inconsistency.

Specifically, the Forwarder appends 'req.from' at the end of 'https://t.co/V3O55570QZ'. However, when the multicall() function processes the parameters, it excludes 'req.from' before executing the actual call. Consequently, when the burn() function invokes _msgSender(), it extracts 'req.from' from the end of the calldata for TrustedForwarder. Due to the earlier processing by multicall(), 'req.from' has already been discarded. As a result, the last 20 bits of 'https://t.co/V3O55570QZ', which can be manipulated by the attacker, are used.

Our analysis is based on this attack TX: https://t.co/gpON29xMtF

[Loophe Lau @loophe_liu]

@Michael_e18 注意身体

[BlockSec Phalcon @Phalcon_xyz]

. @GROKERC20 was attacked due to the lack of the slippage control, and the loss is ~$56K (26 Ether).
Specifically, in the _transfer function of the #GROK token contract, the swapTokensForEth function can be triggered if the contract balance is greater than _taxSwapThreshold. By abusing this, the attacker could harvest more #GROK tokens with a reverse swap.
Finally, the attacker converted those #GROK tokens back into ETH.

https://t.co/5l6sBmLXWn

[BlockSec Phalcon @Phalcon_xyz]

. @thestandard_io was exploited due to the lack of slippage protection when swapping out the collateral, and the loss is ~$290K.

The attacker first created a CDP (SmartVaultV2) with 10 WBTC as collateral to mint 290,000 EUROs. Subsequently, the attacker forced the SmartVaultV2 contract to execute a swap in the WBTC/PAXG pool, which was manipulated through the sole position the attacker had opened before. It allowed the attacker to drain liquidity and seize all WBTC collateral from the SmartVaultV2 contract, resulting in bad debt for the protocol and profits from the minted EUROs.

Attack Tx: https://t.co/nVnmZAErRv

[Rainier @mtrainier2020]

clash系列基本上全灭了，有些翻墙工具包主创明确在国内的，有关部门貌似也在努力侦测中。
从现在的情况来看，这绝对不是一个地方的行动。翻墙工具在过去几年中，属于灰色地带。你说合法吧，翻墙被抓，被罚款的判决文书一大堆。你说非法吧，科研机构，跨境电商，甚至政府机构都在使用各种翻墙软件在翻墙。
地方的执法机构是没有动力去搞这种活动的，属于吃力不讨好的行为，而且需要大量单位的协调。
那么基本上可以判断是更高级别的统一行动。
为什么呢？
影响到政治稳定了。
过去一年的几件事情，让有关部门如坐针毡。
1. 白纸事件，核心信息沟通的枢纽，全部在国外。国内的人，通过翻墙，通过twitter进行信息的交流，汇总，自发串联。使得国内的高压，封锁形同虚设，强行闯关。
2. 最近的祭奠。虽然国内也是高压管理。但是毫不影响，信息的传播。模式依然是，墙内人翻墙，在外面进行信息的交流。最后把信息倒灌给墙内。（有关部门发明的倒灌这个从词非常生动）。
有关部门，针对推上信息交流的关键节点的攻击似乎没有什么效果。那么很自然的一个想法就是，清理翻墙工具。
完全消灭翻墙是不现实的，道高一尺魔高一丈。但是最近翻墙那么普遍的一个原因，就是翻墙从非常复杂的软件和环境配置，变成了傻瓜一键搞定，大大降低了翻墙的门槛。这个是有关部门不能接受的。
所以，这次集中整治翻墙软件，可能不是一次临时起意的行动，而是持久的扫荡。使得翻墙的难度直接++，使得普通人根本翻不出去。
后续可能/正在做的。
1. 渗透各大翻墙软件群，���取更多人在国内主创的隐私信息。比如xraycore这个社群是，telegram的。这个是非常不安全的平台。搞定，只是一个时间问题。
2.加强打击机场。切断各种各样的支付渠道，以及各种钓鱼手段。让普通人根本没有渠道去拿到翻墙的工具。
3. 限制app。这个已经在做了。就等apple把最后一块砖给堵上了。比如apple 禁止跨区。那基本上就gg了。
4. 抓典型。恐吓式执法。这个以前在某地搞过。
5. 不定期白名单。这个已经在有些地方试点过了。

[tensorfish @tensorfish]

MEV bot got exploited via unprotected callback for 8.88 ETH (~$16k) with a NFT called "Agent Origin (viet_nam)"

Lmao at the similarity to Agent Orange

0x0802cb621535999de2084b49f257d8bd0919cbfe03b186651689a74536e1a792

[Loophe Lau @loophe_liu]

@libevm whats wrong with it!

[BlockSec @BlockSecTeam]

Due to the affected protocol being paused, here is a preliminary analysis of this @Platypusdefi incident:

1. It's a Flashloan attack, with a total loss of ~$2M. The Hacker manipulated 'cash' and 'liability' which affected the swap price.

2. The first attack tx is: https://t.co/esLyNWsPYc

3. There are 2 attackers who carried out the attack:
- 0x0cd4fd0eecd2c5ad24de7f17ae35f9db6ac51ee7
- 0x464073F659591507d9255B833D163ef1Af5ccc2C

4. One of the attackers made a mistake, and the Platypus team successfully rescued $575K! The rescued funds have been transferred to:
0x068e297e8ff74115c9e1c4b5b83b700fda5afdeb

5. We identified that the forked project @hummusdefi has the same issue and immediately contacted the Platypus team to see if they could be notified. hummus defi has been informed and just paused the protocol.

6. This incident continued with multiple attacks. Phalcon Block is an attack prevention system. You're welcome to join the waiting list.

[BlockSec @BlockSecTeam]

2 weeks ago, @Balancer and its fork @beethoven_x sufferd attacks, with total losses ~$2.1M. The subtlety of the bug and its exploitation have remain under-analyzed. In this report we deliver a comprehensive community-engaging analysis.
https://t.co/3kOYltMtnD

[Balancer @Balancer]

Balancer is aware of an exploit related to the vulnerability below.

Mitigation procedures have drastically reduced risks, but are unable to pause affected pools.

To prevent further exploits, users must withdraw from affected LPs.

https://t.co/PDzX32gqeS

[BlockSec Phalcon @Phalcon_xyz]

Emergency mitigation tx on ethereum:
https://t.co/jdBVLkiSsq

[Lefteris Karapetsas @LefterisJP]

You either need to be an idiot or outright malicious to tweet out potential vulnerabilities @BlockSecTeam while there is an ongoing incident

Adding screenshots and asking the potential victim to DM you? IN A PUBLIC TWEET?

I wont even quote your tweet/s but what the actual fuck?

[banteg @banteg]

to all the auditors and autists out there

you 👏 don't 👏 tweet 👏 live 👏 vulns 👏 before 👏 they 👏 are 👏 fully 👏 mitigated