rekt.news can clarify that the $11 million that was stolen, is definitely not safe.
The funds were taken from the protocol’s sUSDv2 metapool in which Synthetix’ sUSD is paired with saddleUSD-V2 LP tokens (from the DAI, USDC, USDT pool).
The exploit was possible due to a bug in an old version of the MetaSwapUtils library which doesn’t use a VirturalPrice to calculate the value of the LP token during metapool swaps.
The issue had been fixed in the current version, but the swap calculation was still using the old version.
The hacker made a series of flash loan assisted sUSD/saddleUSD-V2 swaps in the metapool, manipulating the price of the LP token which could then be swapped back for more sUSD.
Main hack tx for (3375 ETH): 0x2b023d…
Second hack tx (for 557 ETH): 0xe7e047…
Though funds have begun to move through Tornado Cash, at the time of writing, the majority remains in the exploiter’s address.
In November of last year, Saddle published a report on the vulnerability after a $8.2M near-miss for Synapse protocol who were using some Saddle code.
BSC-based nerve.fi were also hit via the same attack vector.
The resulting fix to the MetaSwapUtils library was made in December but, apparently, the code wasn’t implemented into metapool swaps properly.
Saddle forking Curve: if it ain’t broke don’t fix it.
Saddle not implementing their own fix: if it ain't fixed don't use it.
REKT serves as a public platform for anonymous authors, we take no responsibility for the views or content hosted on REKT.
donate (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C
REKT is not responsible or liable in any manner for any Content posted on our Website or in connection with our Services, whether posted or caused by ANON Author of our Website, or by REKT. Although we provide rules for Anon Author conduct and postings, we do not control and are not responsible for what Anon Author post, transmit or share on our Website or Services, and are not responsible for any offensive, inappropriate, obscene, unlawful or otherwise objectionable content you may encounter on our Website or Services. REKT is not responsible for the conduct, whether online or offline, of any user of our Website or Services.
you might also like...
What a way to start the week. This morning, Mixin Network announced a loss of $200M. The project claims to be “decentralised”, but has blamed the losses on a hacked third-party database. Where's the accountability?
Another exchange drained, is Lazarus going for a September hat-trick? Remitano's hot wallets were hit for $2.7M, yesterday. But quickly frozen USDT ensured profits were vastly reduced. Are we… learning?
rekt across thirteen chains. Is that a new record? CoinEx has become the latest crypto custodian to have its hot wallets emptied, losing an eventual total of $54.3M. How long until the next CEX is hit?