Crypto Intelligence Guest Post: Millions at Risk: Curve Finance’s Liquidity Pools Attacked by Vyper Vulnerability Exploit

On July 30, multiple liquidity pools within Curve Finance, a major decentralized finance (DeFi) protocol, were targeted by an attack based on a vulnerability discovered in the Vyper programming language.

Vyper was built specifically for the Ethereum Virtual Machine (EVM) to facilitate the development of smart contracts.

Curve Finance’s prominence in the DeFi space is largely due to its key liquidity services.

However, the latest code vulnerability put approximately $100 million worth of digital assets at risk and sparked concern in the community.

The bug was identified in versions 0.2.15, 0.2.16 and 0.3.0 of the Vyper language and resulted in incorrect reentry locking.

As a result, millions of dollars were withdrawn from four curve pools, namely aETH/ETH, msETH/ETH, pETH/ETH and CRV/ETH.

Additionally, the impact of this vulnerability on three of its variants has the potential to affect other protocols in the DeFi ecosystem.

Following the attack, Curve Finance’s native token, CRV, saw a sharp drop in value on decentralized exchanges.

However, the situation was saved when centralized exchange price feeds came into play.

READ MORE: SEC suffers setback as court overturns ruling on SPIKES index security classification

CRV price fell to $0.086 on decentralized exchanges while maintaining a trading value of $0.60 on centralized exchanges (CEXs), preventing the token from collapsing outright.

The recovery has been attributed to the integration of Chainlink’s Oracle system with Curve pools, which incorporates price feeds from various sources, including centralized exchanges.

Without the CEX price feed, Curve Finance would have faced a complete collapse.

This irony caught the attention of Binance CEO Changpeng Zhao, who found the fact that a CEX price feed ultimately saved the DeFi protocol hilarious.

Zhao clarified that the Vyper vulnerability does not affect Binance as the exchange promptly updated its code to the latest version. He also stressed the importance of regularly updating code libraries to maintain robust security measures.

The bug in the earlier Vyper versions is estimated to be at least 1.5 years old, indicating that the attacker invested significant time and resources exploiting this vulnerability in a high quality protocol.

A contributor to the Vyper program on Twitter even hinted that the effort that went into the exploit points to a possible state-sponsored attack.

As the DeFi space continues to evolve and gain traction, incidents like these underscore the importance of thorough code audits, timely upgrades, and vigilance for potential vulnerabilities to ensure the security and resilience of decentralized finance protocols.

Other stories:

Margot Robbie’s comparison of Bitcoin to Barbie’s Ken sparks debate

Blockchain could save financial institutions $10 billion by 2030: Ripple FPC report

Tech firms are calling on the European Union to support open-source AI in new regulations

Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers