Force DAO, A DeFi Hedge Fund, Loses Over $375k in xFORCE Token Exploit

2021-4-6 18:52

On Sunday, DeFi hedge fund, ForceDAO announced an attack on its protocol – specifically the xFORCE contract. In a post mortem report from the ForceDAO team, a total of 183 ETH (~$367,000) was drained and liquidated on the contract exploit.

ATTENTION

Our team is aware of the xFORCE contract exploit and has identified the nature of the issue.

There are no further funds available on the xFORCE contract to be exploited.

All other vaults are safe.

We will provide a post-mortem and next steps over the coming hours.

— Force (@force_dao) April 4, 2021

The attack was noticed first by a white-hat hacker, who started draining funds from the xFORCE contract and later returned the funds to the ForceDAO multisig wallet. Explaining the exploit, Polymath’s Mudit Gupta said the FORCE token transfer functions return false rather than reverting when the sender doesn’t have enough balance in their wallet.

“The xFORCE contract assumes FORCE will revert and does not handle the returned value,” Gupta explains.

This means anyone can deposit the synthetic FORCE tokens, xFORCE, even if they do not have any FORCE tokens. Hence, the attackers could mint fresh xFORCE tokens without the xFORCE contract locking up any FORCE tokens.

Once you have the xFORCE tokens, you can withdraw the real FORCE tokens from the xFORCE contract by calling the `withdraw` function and exchanging your xFORCE tokens for FORCE tokens.

The xFORCE contract has already been drained by https://t.co/pCfyPP2NS9

— Mudit Gupta (@Mudit__Gupta) April 4, 2021

Four black hat hackers did not return their funds but rather sold them on the open market totaling $367,000 in losses for the xFORCE contract. Here is a complete list of addresses the hackers used to drain the funds.

Black hat hacker 1: https://etherscan.io/address/0x9d9c3695c54601929cd72d34a52935268eb9b00b BH hacker 2: https://etherscan.io/address/0xe29a07002c7be4299b51a2892799cc4a372994dd BH hacker 3: https://etherscan.io/address/0x0608576ea47b265f1f16b8b8383d0508f703a0cb BH hacker 4: https://etherscan.io/address/0x00000b20f0f6a3a212aa6b85106709cd5941457c

According to the post, Force, xForce, and Force/ETH LPs on UniSwap and SushiSwap were all affected. The team has since removed all xFORCE tokens from the contract to prevent further hacks. Alberto Cevallos, the founder of ForceDAO, confirmed they would be refunding any affected parties in the hack and reward the white hat hacker.

“I can confirm that there will be a snapshot and new token,” Cevallos said. “We’ve begun internal re-structuring and will be announcing a plan over the coming days making any affected FORCE holders and LPs whole.”

The post Force DAO, A DeFi Hedge Fund, Loses Over 5k in xFORCE Token Exploit first appeared on BitcoinExchangeGuide. origin »

Smart Investment Fund Token (SIFT) на Currencies.ru

$ 0 (+0.00%)
Объем 24H $0
Изменеия 24h: 0.00 %, 7d: 0.00 %
Cегодня L: $0 - H: $0
Капитализация $0 Rank 99999
Доступно / Всего 0 SIFT

attackers attack forcedao hedge fund team blog

Источник: bitcoinexchangeguide.com

attackers attack → Результатов: 60


Foxconn Ransomware Attackers Demanded $35 Million Payment In Bitcoin (BTC) to Decrypt Files

According to reports from BleepingComputer, Foxconn, one of the largest electronic companies in the world, was faced with a ransomware attack by a popular hacking group, DopperPaymer. The report confirms the hack was first noticed on November 29th when the hackers gave the company 3 days to make a ransom payment to an unknown wallet […] The post Foxconn Ransomware Attackers Demanded Million Payment In Bitcoin (BTC) to Decrypt Files first appeared on BitcoinExchangeGuide.

2020-12-9 21:19


Supply chains show their weaknesses following Avast and NordVPN attacks

Antivirus solution provider Avast and VPN service NordVPN both disclosed data breaches caused by exposed credentials that granted attackers remote access to internal systems. The twin developments come as supply chain attacks — compromising a third-party vendor with a connection to the true target — targeting security-related apps are becoming a common vector to install malware.

2019-10-22 16:20


Фото:

Ransomware gang breach data backup software used by hundreds of US dental offices

Hundreds of dental offices across the US have been crippled by a ransomware attack targeting a remote data backup service offered by a third-party. PerCSoft and Digital Dental Record (DDR) — the two Wisconsin-based software companies — provide a solution called DDS Safe that delivers triple-layer protection by backing up sensitive medical records to the cloud, an offline workstation, and an in-office hard disk drive.

2019-8-30 15:28


Coinbase being targeted by ‘unique attack’ highlights how serious attackers are about the cryptospace, claims CISO Martin

Philip Martin, Chief Information Security Officer at Coinbase, recently spoke about a hack which the exchange successfully managed to evade. According to Coinbase, the highly sophisticated attack began on 30 May, when a dozen Coinbase employees received an email for a certain Gregory Harris, who was supposedly a Research Grants Administrator at Cambridge University.

2019-8-11 13:00


Sidechains vs Plasma vs Sharding

Special thanks to Jinglan Wang for review and feedback One question that often comes up is: how exactly is sharding different from sidechains or Plasma? All three architectures seem to involve a hub-and-spoke architecture with a central “main chain” that serves as the consensus backbone of the system, and a set of “child” chains containing actual user-level transactions.

2019-6-14 04:03


Security Researcher Uncovers Witty Phishing Attack On Binance Exchange Users

Security Researcher Uncovers Clever Phishing Attack On Binance Users One of the major issues affecting the cryptocurrency industry and a major hindrance to its popularity is lack of security. Cryptocurrency exchanges have been targeted in hacks that have led to the loss of billions of dollars worth of cryptocurrency. However, it seems the attackers are […]

2019-6-3 22:31


Ethereum Classic (ETC) Announces Astor Network Testnet Mining is Ready in Response to 51% Attack

Ethereum Classic network faced a double 51% attack on its platform in the month of January which led to a loss of $1 million. The attackers were able to accumulate 51% of the hash power required to manipulate the network and continued the attack for several days. The attackers used their control on the ETC […]

2019-5-29 18:22


Фото:

Lazarus Hacker Group Continues to Target Crypto Using Faked Trading Software

This article was originally published by 8btc and written by Lylian Tang. The Chinese security service provider 360 Security has issued a warning that a large number of crypto exchanges have been targeted by the North Korean hacker group Lazarus and that the number is still rising after the recent hacks of crypto exchanges DragonEx, Etbox and BiKi.

2019-4-2 21:54


Cyber Attack Comes After Operations of Altran Technologies in France, Can Blockchain Help Prevent Hacks?

Cyber attacks, though highly publicized in the crypto sector, can impact any company with digital operations, which is exactly the predicament that Altran Technologies found themselves in. Altran, a French engineering consultancy, became the target of attackers, inhibiting their operations in several countries simultaneously.

2019-1-29 01:19


Фото:

Security Researchers Reveal Wallet Vulnerabilities On Stage at 35C3

In a demonstration titled “Wallet. fail,” a team of security researchers hacked into the Trezor One, Ledger Blue and Ledger Nano S. Unfortunately, it appears as if their findings were first put on display at the 35th Chaos Communication Congress (35C3) in Leipzig, Germany, rather than through accepted Responsible Disclosure practices, which would have allowed the manufacturers to patch the vulnerabilities and protect their customers from any potential attack.

2019-1-1 19:15


Фото:

A Bug Making Ethereum Transactions on Exchanges Vulnerable Has Been Fixed

A bug centering around a new Ethereum token, GasToken, which was enabling abuse on cryptocurrency exchanges, appears to have been resolved. The details are provided in a report originally published on November 13, 2018, that discussed how the bug was exploited by attackers, and what digital platforms could do if they wished to protect their hot wallet funds.

2018-11-22 00:34


Bitcoin Wallet Samourai Warns Users of “Dusting Attack”

On October 25, 2018, the privacy-centric cryptocurrency wallet Samourai warned users via Twitter of a new type of tracking tactic called a “dusting attack. ” Biting the Dust According to tweets, the attack is an attempt to compromise the security and privacy of Samourai users by using “coin dust” to deanonymize users and linking their transactional inputs together.

2018-10-27 18:00


дальше еще 11 новостей →

Партнеры Currencies.ru



Реклама на Currencies.ru

Самое свежее на Currencies.ru

Solana ETF push resumes as Cboe BZX resubmits applications to SEC

Hopes for a Solana-based spot exchange-traded fund have rekindled after Cboe BZX refiled applications for multiple asset managers. On Jan. 29, Bloomberg analyst James Seyffart highlighted that Cboe BZX has submitted fresh 19b-4 filings for spot Solana ETFs from Bitwise,…