Decentralized finance (DeFi) protocols are under stress testing after a critical vulnerability was discovered in versions of the Vyper programming language that led to the theft of millions of dollars worth of cryptocurrencies on July 30.
Several pools using Vyper 0.2.15, 0.2.16 and 0.3.0 were exploited due to a buggy re-entry lock and targeted at least four liquidity pools in the Curve Finance protocol. “The short answer is: Anything that could be drained was drained. The target pools are aETH/ETH, msETH/ETH, pETH/ETH and CRV/ETH. All remaining pools are safe and unaffected by the error,” Curve Finance said on Discord.
BlockSec, an auditing firm for smart contracts, noted that re-entry could potentially put all pools of wrapped ether (WETH) at risk of attack.
Please note that this re-entry issue is related to the use of “use_eth” which could potentially compromise the WETH related pools! @CurveFinance, please DM us if you need any help. https://t.co/vjc1RRce7w pic.twitter.com/Wz8DXJZK7Y
— BlockSec (@BlockSecTeam) July 30, 2023
Vyper is a contract programming language developed for the Ethereum Virtual Machine (EVM). It is considered to be one of the most widely used Web3 programming languages, which means that the bug could affect several other protocols in three of its versions.
The attack affects a range of decentralized finance projects, with Alchemix’s alETH-ETH reporting $13.6 million outflows, PEGd’s pETH-ETH pool draining $11.4 million, the sETH-ETH Metronome pool was hacked by $1.6 million and recorded over 32 million in Curve DAO (CRV). Over the past few hours, over $22 million worth of tokens have been withdrawn. Decentralized exchange Ellipsis also reported that a small number of stable pools containing BNB were being exploited using an old Vyper compiler.
The crv/eth pool was emptied a few minutes before a whitehack operation :(https://t.co/rhALBzkTEi
— banteg (@bantg) July 30, 2023
The incident also negatively impacted the price of CRV, which fell over 12% to $0.64 at the time of writing. Community members also noted a potential domino effect on Aave’s minutes, as the falling price could force CRV Curve founder Michael Egorov to unwind a $70 million loan position on Aave.
Magazine: Should crypto projects ever negotiate with hackers? Probably
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.