Update:
the balancer hacker has added console logs onchain.
there is also a good probability that the hackers vibe coded the attack or used LLMs.
Here's why I think that:
>hackers usually never leave console.log in production code.
>when console.log does appear on-chain, it’s almost always a mistake.
>a mistake like that only happens if the coder forgot to delete debug lines.
>forgetting to delete debug lines = copy-pasted straight from an LLM.
>LLMs love to add console.log("Step 1") to “help you follow”.
>So when the log says garbage like Done with amts1, it’s mostly AI slop.
balancer went through 10+ audits. the vault was audited 3 separate times by different firms
still got hacked for $110M
this space needs to accept that 'audited by X' means almost nothing. code is hard, defi is harder
it is unfortunate but hope the team recovers
🚨SlowMist TI Alert🚨
MistEye has detected potential suspicious activities related to @Balancer. A loss of approximately $70.58M.
As always, stay vigilant!
https://t.co/OFG5t7kPY8
https://t.co/w1ifSWDbCA
⚡ Head of BD at @CertiK MENA, @lakshyakj joins the 15th anniversary Blockchain Life in Dubai
15,000+ attendees from 130 countries | Oct 28-29
🌍 Join the largest edition in its history:
https://t.co/bKtgkmnN21
We recently had the opportunity to audit @zksync's Airbender codebase, and we were genuinely impressed.
The code was clean, well-structured, and thoughtfully engineered.
ZKsync’s approach to scaling Ethereum with advanced ZK-rollup infrastructure is raising the bar for the entire space.
Proud to contribute to the security of such high-impact technology.
.@MIM_Spell was attacked hours ago, resulting in a loss of ~$1.7M. The root cause stems from the flawed implementation logic of the cook function, which allows users to execute multiple predefined operations in a single transaction. Specifically, the actions share a common status, which may lead to the bypassing of the insolvency check.
The details are as follows:
1. When action = 5 (ACTION_BORROW), a borrowing operation is executed, and status.needsSolvencyCheck is set to true.
2. When action = 0, the internal function _additionalCookAction is called to update the status. However, this function is an empty function and defaults to returning status.needsSolvencyCheck = false, thereby overwriting the previous check flag and skipping the final insolvency check.
The attacker called the cook function on 6 different addresses, passing in actions = [5, 0], obtained 1,793,755e18 MIM, and subsequently profited through swaps.
Attack TX: https://t.co/zREwcYS0iV
This bull market has been the opposite of what I was expecting. I'm so pissed off and upset. Unfortunately, I longed Eth at $4,800 with leverage 20X and got liquidated.
Therefore, I'm forced to move back home to Canada to live with my parents.
This is my last post ever. Goodbye.