Transaction batching protocol Furucombo suffers $14 million “evil contract” hack

The latest “evil contract” exploit has netted an attacker over $14 million in stolen funds.

Furucombo, a tool designed to help users “batch” transactions and interactions with multiple protocols at once, fell victim to the attack which centered on token approvals from users.

The attacker’s address currently has $14 million is various cryptocurrencies, but the attack appears to be larger as they have been transferring ETH to privacy mixer Tornado Cash in batches over the last hour.

This attack is conceptually similar to the $20 million “evil jar” attack that struck Pickle Finance last year, as well as the $37 million “evil spell” exploit that hit Alpha Finance earlier this month. In these “evil contract” exploits, an attacker creates a contract that fools a protocol into believing it belongs there, giving them access to protocol funds.

在这种情况下, the attacker ‘tricked’ the Furucombo protocol into thinking that their contract was a new verison of Aave. 从那里, instead of draining funds from the protocol as in previous evil contract exploits, they instead leveraged the ability to take the funds of every user who had given the protocol token permissions.

“Infinite permissions means you can wipe everyone who interacted with Furucombo,” said whitehat hacker and co-founder of DeFi Italy in a statement to Cointelegraph.

This exploit type appears to be growing increasingly popular, now accounting for over $70 million in user funds lost in just a few months.

The team confirmed the attack in a Tweet, saying that they “believed” they’d mitigated the exploit but recommended revoking permissions “out of an abundance of caution:”

Users can leverage tools like revoke.cash to do so.

The attack comes during a period of wider reflection in the DeFi world on security and the utility of auditing companies. In the last three months, three different auditing and code review services have emerged, each with a different incentive model designed to encourage more thorough and dynamic security practices.

让我们屏蔽广告! (为什么?)

资源: 声电图

正在加载...