BlockThreat - Week 31, 2023
Curve | Bitfinex | LeetSwap | Uwerx | HVNC
Greetings!
Finally, some much needed good news this week.
The Bitfinex saga is coming to the end with a guilty plea and an admission that Lichtenstein was indeed the one who hacked the exchange 7 years ago. A massive $20m zero transfer phishing theft was stopped in time by Tether.
More than $50m was returned by Vyper attackers to Curve, Alchemix, and JPEGD projects. Once again, blackhats are being encouraged to turn to the light side with a significant bug bounty and may be a bit of doxxing. A $1.85m hunt was just declared on the remaining bad actor. Good luck!
LeetSwap protocol was hacked for $624k days before the official Base chain launch with an always unfortunate insufficient function access control exploit. Luckily developers were able to negotiate a 10% bounty and returned most of the stolen assets. Two other projects were hit with price oracle manipulation exploits for combined $367k in losses while another anonymous contract on Arbitrum lost $846k.
macOS crypto users need to remain vigilant as two new malware strains target their wallet keys and exchange credentials.
As always, this week features a fantastic collection of research papers. I would point you to a compilation of techniques to quickly enumerate vulnerable contracts using Dune, Smart Contract Fiesta, and other projects as well as a whitehacks toolkit the next time you need to spin up a rescue operation. Every minute counts as we learned from the Curve hack where the good guys were beaten by mere minutes.
To gain access to comprehensive vulnerability write-ups, post-mortems, exploit proof of concepts (PoCs), attacker addresses, and additional data regarding this week’s compromises, please subscribe to the premium plan below.
Let’s dive into the news!
News
JPEGD and Alchemix returned all of the stolen funds with attacker sending a mocking message on-chain. More than $50m were returned from the Vyper-related compromises. Only one other wallet continues holding $18.5m in WETH and CRV tokens refusing to accept the whitehat bounty.
Curve offering $1.85 million bounty for exploiter's identity (and conviction).
Crime
Bitcoin launderer pleads guilty, admits to massive Bitfinex hack.
U.S. SEC Sues Richard Heart, Hex, PulseChain on Unregistered Securities, Fraud Allegations.
Two sentenced after Telecoin crypto scam ended by ‘Operation Curry’.
Scams
FBI warns of scammers posing as NFT devs to steal your crypto.
Monthly stolen NFT value declining alongside traders and volume.
Zero transfer scammer steals $20M USDT, gets blacklisted by Tether.
BALD $23m rugpull analysis by Rekt.
Malware
The Massive macOS Threats Trending in the Dark Web by Guardz. The new macOS-HVNC malware is capable of steal crypto assets, logic credentials, and other sensitive data.
New NodeStealer Variant Targeting Facebook Business Accounts and Crypto Wallets.
Contests
MEV-Share CTF Writeups by minaminao.
Media
ETH Barcelona featured a number of security related talks. Here are just a few that I had a chance to watch:
Security research as a public good for Ethereum - Tincho (The Red Guild).
The Blockchain Guardians: Safeguarding the Future of Ethereum Smart Contract Security - Luksgrin (Secureum, SpearbitDAO).
How to Write Better Smart Contracts By Checking Them With Slither by Troy Sargent (Trail of Bits).
Research
Establishing On-Chain Communication After an Incident by Slowmist.
Becoming a web 3 security researcher: Balancing foundations and the attacker mindset by Joran Honig.
Force-feeding Smart Contract Attacks - How to influence a smart contract's internal accounting by r4bbit.
LSD. Integration pitfalls by Pavel Morozov (MixBytes).
Vyper Nonreentrancy Lock Vulnerability Technical Post-Mortem Report.
Smart Contract Security Audit: Sudoswap v2 by Giovanni Di Siena (Cyfrin).
Shared Vulnerabilities Between ERC-4626 Vaults and Vault-Like Contracts by Alexis Williams (Arbitrary Execution).
Unmasking the Phantom: The Intricate Shadow Transactions Attack Deciphered by GoPlus Security.
Computing a list of vulnerable Vyper contracts using Zellic’s Smart Contract Fiesta by cts.
Computing a list of vulnerable Vyper contracts using Dune Analytics by Patrick Collins.
Computing a list of vulnerable Vyper contracts using polars and parquet by banteg.
Gas optimization resources by Jeffrey Sholz.
Tools
Whitehacks Kit - A simple template to perform whitehacks safely in a single tx, leveraging Foundry and Flashbots.
unchained-reader - tool for reading Unchained index files.
solidity-audit-report-generator - a VS Code extension that automatically generates audit reports based on contest templates, ChatGPT, and
// @auditcomments.
Enjoy reading BlockThreat? Consider sponsoring the next edition or becoming a paid subscriber to unlock the premium section with detailed information on hacks, vulnerability, indicators, special reports, and searchable newsletter archives.