OShield 🛡️

Smart Contract Auditing and Security Services 🛡️

[OShield 🛡️ @oshield_io]

When you ship ...
Consult the #OShield.

[OShield 🛡️ @oshield_io]

@uriklarman @readylayerone Can vouch ☝️

[OShield 🛡️ @oshield_io]

@MSAlmalik 🙏

[SolanaFloor @SolanaFloor]

UPDATE: Following earlier concerns by @oshield_io tied to the exploit, SolanaFloor has confirmed from its sources that the @DriftProtocol team is safe and not in any physical danger.

[OShield 🛡️ @oshield_io]

@SolanaFloor @DriftProtocol Thank God!

[OShield 🛡️ @oshield_io]

Update — @DriftProtocol uses two different multisig wallets both with the same set of members.

1 ) Risk Council —

2-of-5 multisig that two of the keys were compromised to upgrade the program’s admin key and setup the vault for the scam token CVT

https://t.co/7dJgyUb5uW

1) Program Upgrade —

3-of-5 multisig that around an hour ago signed a transaction to upgrade the program. It was approved by the other 3 members apart from the confirmed 2 compromised members.

https://t.co/hNTGb1RSXk

Attacker most likely did not compromise all wallets as the program upgrade seems to be benevolent.

This is CRAZY!

[OShield 🛡️ @oshield_io]

@pattiruss_ @bangerz @DriftProtocol 1) They are physically in danger

2) The infra they use for their keys has been compromised and has even a bigger issue.

[OShield 🛡️ @oshield_io]

Summary of the @DriftProtocol Exploit thus far:

1) Someone on Drift multisig has updated the drift state account to change the admin here.

https://t.co/qZWnNjmbCQ

2) This member on the multisig approved the change

https://t.co/OFWYP6DyOR

3) And the current admin and attacker is this account.

https://t.co/5fdzN3GaGH

4) The attacker used this key to initialize spot market vault for a CVT ( scam propped up token) with high oracle price here.

https://t.co/Tr1XPQWib4

5) Deposits CVT and withdraws actual tokens using the cross-margin and swap functionality on Drift.

6) Program upgrades is happening to regain back the admin as per our latest analysis.

[OShield 🛡️ @oshield_io]

Update —

[OShield 🛡️ @oshield_io]

The main issue is that two keys from the multisig has been compromised,

https://t.co/z6sM0zXKUZ…

And

https://t.co/GAN6367zpM…

Concerning that the physical security of the team might be in danger.

[OShield 🛡️ @oshield_io]

@pattiruss_ @bangerz @DriftProtocol Very unlikely

[OShield 🛡️ @oshield_io]

The main issue is that two keys from the multisig has been compromised,

https://t.co/z6sM0zXKUZ…

And

https://t.co/GAN6367zpM…

Concerning that the physical security of the team might be in danger.

[OShield 🛡️ @oshield_io]

@GrimLothar https://t.co/t6fZxnRnKJ

[OShield 🛡️ @oshield_io]

The main issue is that two keys from the multisig has been compromised,

https://t.co/z6sM0zXKUZ…

And

https://t.co/GAN6367zpM…

Concerning that the physical security of the team might be in danger.

[OShield 🛡️ @oshield_io]

@ZER0_Mono @DriftProtocol Very unlikely

[OShield 🛡️ @oshield_io]

The main issue is that two keys from the multisig has been compromised,

https://t.co/z6sM0zXKUZ…

And

https://t.co/GAN6367zpM…

Concerning that the physical security of the team might be in danger.

[OShield 🛡️ @oshield_io]

The main issue is that two keys from the multisig has been compromised,

https://t.co/z6sM0zXKUZ…

And

https://t.co/GAN6367zpM…

Concerning that the physical security of the team might be in danger.

[OShield 🛡️ @oshield_io]

Summary of the @DriftProtocol Exploit thus far:

1) Someone on Drift multisig has updated the drift state account to change the admin here.

https://t.co/qZWnNjmbCQ

2) This member on the multisig approved the change

https://t.co/OFWYP6DyOR

3) And the current admin and attacker is this account.

https://t.co/5fdzN3GaGH

4) The attacker used this key to initialize spot market vault for a CVT ( scam propped up token) with high oracle price here.

https://t.co/Tr1XPQWib4

5) Deposits CVT and withdraws actual tokens using the cross-margin and swap functionality on Drift.

6) Program upgrades is happening to regain back the admin as per our latest analysis.

[OShield 🛡️ @oshield_io]

@DriftProtocol @tracy_codes https://t.co/bPI0v9QxX3

[OShield 🛡️ @oshield_io]

Summary of the @DriftProtocol Exploit thus far:

1) Someone on Drift multisig has updated the drift state account to change the admin here.

https://t.co/qZWnNjmbCQ

2) This member on the multisig approved the change

https://t.co/OFWYP6DyOR

3) And the current admin and attacker is this account.

https://t.co/5fdzN3GaGH

4) The attacker used this key to initialize spot market vault for a CVT ( scam propped up token) with high oracle price here.

https://t.co/Tr1XPQWib4

5) Deposits CVT and withdraws actual tokens using the cross-margin and swap functionality on Drift.

6) Program upgrades is happening to regain back the admin as per our latest analysis.

[OShield 🛡️ @oshield_io]

@solquicks @solflare 🫡

[OShield 🛡️ @oshield_io]

Oshield is proud to partner with @solflare on security.

We audited Solflare Shield (hardware wallet) and Solflare Card (crypto debit card), confirming strong protections for users.

All critical and high-severity issues were patched before launch.

Security first. 🛡

[OShield 🛡️ @oshield_io]

@chesscom Chess

[OShield 🛡️ @oshield_io]

@charliekirk11 @realDonaldTrump Parriot

[OShield 🛡️ @oshield_io]

@DeFiTuna 🤝🤝🤝

[OShield 🛡️ @oshield_io]

https://t.co/WAejVwXUtL

[OShield 🛡️ @oshield_io]

We completed an audit of @DeFiTuna ‘s leveraged product. 2 critical vulnerabilities were identified alongside a number of high and medium severity level issues.

All bugs have been patched and fixes are implemented. Tuna is safely deployed on top of @FusionAMM markets and @orca_so whirlpools.

Read the full report on our publications page 👇