Need an audit?
You shouldn’t need 20 intros, Telegram groups, and weeks of back-and-forth just to find the right security firm.
@Procur3 now has 50+ security firms live on the platform, including some of the biggest names in Web3 security.
Find the right fit faster.
Last week StablR lost $10.4M to a multisig exploit.
This week, Superfortune lost $15.18M when a multisig execution silently swapped the recipient address — and nobody caught it until the tokens were gone.
Multisig is the leading exploit cause in value.
Details below.
When you've paid for the best audit firms to secure your smart contracts, use https://t.co/SJg8UJuoxM to source:
- Multisig configuration audits / reviews
- Cloud infrastructure and deployment reviews
- Front-end testing
- Penetration testing and more from 50+ verified firms.
How to protect against the Superfortune vector:
- Air-gap your signing device
- Never approve a destination from the browser UI alone
- Verify the full tx payload on your device (Ledger / Trezor)
An audit doesn't tell you what your signers see when approving a tx at midnight.
It doesn't test whether the destination can be swapped between signing and execution.
It doesn't verify your signers use hardware devices that independently render the destination address.
May 28. DxSale. $7.3M.
Legacy LP lockers from 2021, emptied. Owner privileges used to set fees near-zero, backdate unlock times to 1970, withdraw 1,400+ positions.
On-chain links suggest team involvement. Project silent.
Also in the news:
May 30. Gravity Bridge — cross-chain between Ethereum and Cosmos.
Compromised signing key.
$5.4M drained in USDC, ETH, and USDT. ~2,102 ETH still in the attacker's wallet, being laundered via mixers.
No official statement.
This is a multisig address substitution attack.
The signers approved. The contract executed correctly. But the destination was changed between signing and execution.
If you're not verifying the destination on your hardware device, you're trusting a screen you can't trust.
May 27. Superfortune ($GUA).
Routine multisig tx — transferring unlocked tokens to their airdrop contract.
The destination was tampered.
~15M GUA sent to a hacker wallet. Dumped for 2,784 ETH (~$5.66M). GUA dropped 76%.
Last week StablR lost $10.4M to a multisig exploit.
This week, Superfortune lost $15.18M when a multisig execution silently swapped the recipient address — and nobody caught it until the tokens were gone.
Multisig is the leading exploit cause in value.
Details below.
Them: "We need a audit from a leading auditor"
Us: "Ok, what else?"
Them: "Need to start asap"
Us: "Ok, what else?"
Them: "They need to be specialists and good value for money"
Us: "Ok, what else?"
Them: "I don't know where to find them"
Us: "Dw, I know a place"
Procur3.
You bought a "regulated, MiCA-compliant, audited" stablecoin.
Saturday night, someone minted $10.4M of it out of thin air - with a single stolen key.
EURR: €0.88. USDR: $0.63.
The StablR exploit. Details below
If you're a protocol, DAO, or stablecoin issuer:
You likely audited your contracts
More than likely didn't do an "Admin" audit.
Review your setup: https://t.co/nr8OCs9LKt
Find vetted security firms who can audit your multi-sig configuration and more: https://t.co/SJg8UJuoxM
You bought a "regulated, MiCA-compliant, audited" stablecoin.
Saturday night, someone minted $10.4M of it out of thin air - with a single stolen key.
EURR: €0.88. USDR: $0.63.
The StablR exploit. Details below
Per @sealalliance's Multisig Framework:
→ Minting = critical function = (3-of-5 minimum)
→ Hardware wallet enforced for every signer
→ Dedicated signing devices, air-gapped where possible
→ Signer onboarding and on-chain monitoring
All documented.