Four projects got rugged through their shared anti-rug mechanism.
The project’s website claims to protect over $2.5B of assets, but considering the low liquidity of their selection of shitcoins, we can consider this claim to be optimistic at best.
#46 on the leaderboard.
The announcement of the hack explained that the exploit targeted “the audited v2 to v3 migration function.”
The vulnerability was contained in one of the Liquidity Locks’ “bulletproof smart contracts” which allowed projects to migrate locked LP positions from Uni v2 to Uni v3.
According to Peckshield’s analysis:
The protocol has a flawed migrate() that is exploited to transfer real UniswapV2 liquidity to an attacker-controlled new V3 pair with skewed price, resulting in huge leftover as the refund for profit. Also, the authorized sender check is bypassed by locking any tokens.
The breakdown of the loss to each project’s Uniswap v2 pool is as follows:
Exploiter address 1: 0x161cebb807ac181d5303a4ccec2fc580cc5899fd
Exploiter address 2 (containing stolen funds): 0xba399a2580785a2ded740f5e30ec89fb3e617e6e
Attack tx: 0xb2e3ea72…
Attacker’s contract: 0xcff07c4e6aa9e2fec04daaf5f41d1b10f3adadf4
The vulnerable migrate() function was included in Zokyo Security’s audit of Team Finance contracts from August this year.
“DAO tooling” was amongst the most popular buzzwords throughout the last cycle.
For small, anon teams working on innovative protocols, it may be tempting to outsource trust to a third party. But given the array of shitcoins “secured” by Team Finance, the vaults seem more likely to be a way for projects to appear trustworthy by proxy.
Now that it’s clear that trust has been lost.
Will this protocol take one for the team and reimburse the victims, or is it every man for himself?
There’s no $ in Team.
REKT serves as a public platform for anonymous authors, we take no responsibility for the views or content hosted on REKT.
donate (ETH / ERC20): 0x3C5c2F4bCeC51a36494682f91Dbc6cA7c63B514C
REKT is not responsible or liable in any manner for any Content posted on our Website or in connection with our Services, whether posted or caused by ANON Author of our Website, or by REKT. Although we provide rules for Anon Author conduct and postings, we do not control and are not responsible for what Anon Author post, transmit or share on our Website or Services, and are not responsible for any offensive, inappropriate, obscene, unlawful or otherwise objectionable content you may encounter on our Website or Services. REKT is not responsible for the conduct, whether online or offline, of any user of our Website or Services.
you might also like...
BonqDAO got bonked for $120M, but the anonymous attacker got away with less than $2M. The hacker was able to manually update the price feed of collateral by staking just $175 worth of TRB tokens.
The Midas touch has backfired, leaving a $660K hole in one of its jFIAT pools. The read-only reentrancy vulnerability is a known weakness of a recently introduced collateral type. Let’s hope this rushed decision doesn’t prove to be Midas’ undoing this time…
On Friday, Raydium, a Solana-based AMM, lost a total of $4.4M in fees from its liquidity pools. Post-FTX, the future of Solana feels uncertain...