[WP-H3] Imprecise management of users' allowance allows the admin of the upgradeable proxy contract to rug users

Lines of code Vulnerability details In the current implementation, when there is a fee on follow or collect, users need to approve to the follow modules or collect module contract, and then the Hub contract can call processFollow and transfer funds from an arbitrary address as the follower...

A $320 Million Crypto Hack Sends the DeFi World Reeling

Plus: News Corp gets hacked, UK snacks ransomware, and more of the week's top security news...

Wormhole Crypto Platform: ‘Funds Are Safe’ After $314M Heist

Wormhole – a web-based blockchain “bridge” that enables users to convert cryptocurrencies – said on Thursday that “all funds are safe” after attackers abused a vulnerability to shake it down for 120,000 Ethereum approximately $314 million. In a postmortem shared with Threatpost on Thursday,...

SnatchCrypto attack hits DeFi and Blockchain Platforms with backdoor

By Waqas Kaspersky researchers believe that North Korean government-backed hackers from the Lazarus Group are behind the SnatchCrypto attack. The… This is a post from HackRead.com Read the original post: SnatchCrypto attack hits DeFi and Blockchain Platforms with backdoor...

Missing slippage/min-return check in the curve Pool

Handle defsec Vulnerability details Impact Trades can happen at a bad price and lead to receiving fewer tokens than at a fair market price. The attacker's profit is the protocol's loss. Proof of Concept The NonUSTStrategy contract is missing slippage checks which can lead to being vulnerable to...

Slippage protection

Handle pauliax Vulnerability details Impact exchangeunderlying in functions swapUnderlyingToUst and swapUstToUnderlying lack slippage control, it uses a default value of 0 minimum received. A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker...

$10m of funds goes missing in what appears to be a cryptocurrency rug-pull

There’s a lot of concern in the cryptocurrency realm at the moment. A yield farming platform "utilizing arbitrage to gain optimal yield with low risk" has gone AWOL. Site down, Twitter account deleted, no word from the team behind it explaining what happened. Worst of all, some $10 million worth ...

Hackers Steal $200 Million Worth of Cryptocurrency Tokens from BitMart Exchange

Cryptocurrency trading platform BitMart has disclosed a "large-scale security breach" that it blamed on a stolen private key, resulting in the theft of more than $150 million in various cryptocurrencies. The breach is said to have impacted two of its hot wallets on the Ethereum ETH blockchain and...

Hackers steal $120m from Badger Defi and $30m from MonoX

By Waqas MonoX security breach was caused by a bug in smart contracts meanwhile Badger is still investigating the incident. This is a post from HackRead.com Read the original post: Hackers steal $120m from Badger Defi and $30m from MonoX...

Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable

A new malware campaign has been discovered targeting cryptocurrency, non-fungible token NFT, and DeFi aficionados through Discord channels to deploy a crypter named "Babadeda" that's capable of bypassing antivirus solutions and stage a variety of attacks. "This malware installer has been used in ...

No slippage protection in VaderPoolV2.mintSynth

Handle cmichel Vulnerability details The VaderPoolV2.mintSynth implicitly performs a "native - foreign" swap using VaderMath.calculateSwapnativeDeposit,reserveNative,reserveForeign, the resulting amount will be minted as synths instead of transferred out as foreign tokens. The calculateSwap...

Hacker stole $55M worth of crypto from DeFi lender bZx via phishing

By Waqas The hack took place after one of the bZx's employees was sent a phishing email embedded with a malicious macro hidden in an MS word document, This is a post from HackRead.com Read the original post: Hacker stole $55M worth of crypto from DeFi lender bZx via phishing...

Missing slippage checks

Handle cmichel Vulnerability details The contracts are missing slippage checks which can lead to being vulnerable to sandwich attacks. A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets...

Compound DeFi Platform Gives Out $90M

Compound, an Ethereum-based decentralized finance DeFi platform, accidentally gave out $90 million to its users in a botched upgrade. Now, the owners would appreciate it if they gave it back. Compound might even be willing to throw in a 10 percent “reward,” it said. On the flip side, those who...

PepeAuctionSale Access Control Error Vulnerability

PepeAuctionSale is a DeFi aggregator on Etherscan. An access control error vulnerability exists in PepeAuctionSale, which stems from the fact that the time check operation in PepeAuctionSale 1.0 can be made invalid by assigning a large number to the duration variable, thus affecting access to the...

Cream Finance DeFi Platform Rooked For $29M

Cream Finance is the latest decentralized finance DeFi platform for cryptocurrency trading to take a major financial hit at the hands of hackers, losing nearly $19 million in an attack this week on its “flash loan” feature. The attacker was able to steal nearly $29 million before being discovered...

Poly Network Recoups $610M Stolen from DeFi Platform

A threat actor called “Mr. White Hat” has returned the $610 million they stole from the decentralized finance platform Poly Network. The breached company did everything from threaten to sic law enforcement on the attacker on up to its ultimate offer: the position of chief security officer in...

Hackers Steal Over $600 Million Worth of Cryptocurrencies from Poly Network

Hackers have siphoned $611 million worth of cryptocurrencies from a blockchain-based financial network in what's believed to be one of the largest heists targeting the digital asset industry, putting it ahead of breaches targeting exchanges Coincheck and Mt. Gox in recent years. Poly Network, a...

Defi protocol THORChain loses $8 million in “seemingly whitehat” attack

By Deeba Ahmed THORChain said that "the hacker deliberately limited their impact, seemingly a whitehat." This is a post from HackRead.com Read the original post: Defi protocol THORChain loses $8 million in "seemingly whitehat" attack...

Musk-Themed ‘$SpaceX’ Cryptoscam Invades YouTube Ads

YouTube fans have been swindled out of almost $1 million and counting thanks to an extremely convincing fake SpaceX crypto-coin campaign that uses a popular decentralized finance protocol called Uniswap. The scam is rearing its Elon-Musk-themed head in ads on YouTube that show up before and after...