Over the weekend, another DeFi protocol was exploited for about 2600 ETH, worth more than $10 million.

Rari Capital, whose first product is focused on delivering the highest yield, was attacked on Saturday. The funds were extracted from its Ethereum Pool before the attacker was stopped by pausing the contracts — the loss amounting to 60% of all users’ funds in the Pool.

The team shared in its post mortem that its Ethereum Pool deposits the ETH into Alpha Finance’s ibETH token as a yield-generating strategy.

What the attacker did was flashloan ETH from dYdX, deposit that ETH into the Pool, manipulate the value of `ibETH.totalETH()` by pushing it artificially high, and withdraw more ETH from Pool.

According to Alpha Finance, `ibETH.totalETH()` is manipulatable inside the `ibETH.work` function, and a user of `ibETH.work` can call any contract it wants to inside `ibETH.work,` including the Rari Capital Ethereum Pool deposit and withdrawal functions, but Rari Capital contributors were not aware of it.

To avoid any such issues in the future, Rari Capital will list the protocols it integrates to review their integrations. Also, prevent deposits and withdrawals in the same block or timelock by up to one hour to mitigate the speed of potential attacks.

Furthermore, the team will be checking invariants that shouldn’t need to be checked, internally review the protocols they are looking to integrate with for attack vectors, and enlist more top auditing firms other than Quantstamp and Omniscia.

The project already has another audit planned with OpenZeppelin.

Late on Sunday, the team announced that RariCapital would be becoming a decentralized autonomous organization (DAO), and the team’s allocation of $2 million RGT will be going to it.

As such, “There is no more Rari Capital team. There are only contributors to the protocol,” Jai Bhavnani of Rari capital.

“Decentralization was inevitable, the hack just accelerated evolution,” said Tetranode, an investor in the project.

In the next step, the team focuses on the reimbursement proposals that will go through the voting process.

Similar to Notcoin - Blum - Airdrops In 2024

origin »

194 +