• bitcoinBitcoin (BTC) $ 62,663.00
  • ethereumEthereum (ETH) $ 2,458.07
  • tetherTether (USDT) $ 1.00
  • bnbBNB (BNB) $ 571.66
  • solanaSolana (SOL) $ 147.65
  • usd-coinUSDC (USDC) $ 0.999954
  • xrpXRP (XRP) $ 0.530204
  • staked-etherLido Staked Ether (STETH) $ 2,457.03
  • dogecoinDogecoin (DOGE) $ 0.110288
  • tronTRON (TRX) $ 0.162021
  • the-open-networkToncoin (TON) $ 5.19
  • cardanoCardano (ADA) $ 0.346371
  • avalanche-2Avalanche (AVAX) $ 29.11
  • shiba-inuShiba Inu (SHIB) $ 0.000018
  • wrapped-stethWrapped stETH (WSTETH) $ 2,902.02
  • wrapped-bitcoinWrapped Bitcoin (WBTC) $ 62,489.00
  • wethWETH (WETH) $ 2,457.50
  • chainlinkChainlink (LINK) $ 10.69
  • suiSui (SUI) $ 2.31
  • bitcoin-cashBitcoin Cash (BCH) $ 321.55
  • polkadotPolkadot (DOT) $ 4.16
  • daiDai (DAI) $ 1.00
  • uniswapUniswap (UNI) $ 7.67
  • nearNEAR Protocol (NEAR) $ 4.68
  • leo-tokenLEO Token (LEO) $ 6.08
  • aptosAptos (APT) $ 10.39
  • litecoinLitecoin (LTC) $ 64.50
  • bittensorBittensor (TAO) $ 648.61
  • wrapped-eethWrapped eETH (WEETH) $ 2,581.19
  • pepePepe (PEPE) $ 0.000010
  • fetch-aiArtificial Superintelligence Alliance (FET) $ 1.43
  • internet-computerInternet Computer (ICP) $ 7.87
  • kaspaKaspa (KAS) $ 0.132657
  • first-digital-usdFirst Digital USD (FDUSD) $ 0.998716
  • polygon-ecosystem-tokenPOL (ex-MATIC) (POL) $ 0.365854
  • moneroMonero (XMR) $ 149.65
  • ethereum-classicEthereum Classic (ETC) $ 18.49
  • stellarStellar (XLM) $ 0.090125
  • dogwifcoindogwifhat (WIF) $ 2.66
  • blockstackStacks (STX) $ 1.72
  • okbOKB (OKB) $ 41.44
  • immutable-xImmutable (IMX) $ 1.50
  • ethena-usdeEthena USDe (USDE) $ 0.998786
  • aaveAave (AAVE) $ 154.50
  • whitebitWhiteBIT Coin (WBT) $ 15.29
  • optimismOptimism (OP) $ 1.71
  • render-tokenRender (RENDER) $ 5.41
  • filecoinFilecoin (FIL) $ 3.56
  • crypto-com-chainCronos (CRO) $ 0.075623
  • injective-protocolInjective (INJ) $ 20.33
  • mantleMantle (MNT) $ 0.605086
  • hedera-hashgraphHedera (HBAR) $ 0.050931
  • arbitrumArbitrum (ARB) $ 0.525681
  • fantomFantom (FTM) $ 0.669858
  • vechainVeChain (VET) $ 0.022199
  • sei-networkSei (SEI) $ 0.486391
  • cosmosCosmos Hub (ATOM) $ 4.32
  • thorchainTHORChain (RUNE) $ 4.82
  • the-graphThe Graph (GRT) $ 0.165391
  • bitget-tokenBitget Token (BGB) $ 1.09
  • binance-peg-wethBinance-Peg WETH (WETH) $ 2,453.69
  • bonkBonk (BONK) $ 0.000021
  • rocket-pool-ethRocket Pool ETH (RETH) $ 2,748.46
  • popcatPopcat (POPCAT) $ 1.36
  • flokiFLOKI (FLOKI) $ 0.000136
  • celestiaCelestia (TIA) $ 6.12
  • theta-tokenTheta Network (THETA) $ 1.28
  • arweaveArweave (AR) $ 19.20
  • mantra-daoMANTRA (OM) $ 1.47
  • mantle-staked-etherMantle Staked Ether (METH) $ 2,568.56
  • pyth-networkPyth Network (PYTH) $ 0.324387
  • gatechain-tokenGate (GT) $ 9.12
  • makerMaker (MKR) $ 1,330.50
  • worldcoin-wldWorldcoin (WLD) $ 2.19
  • solv-btcSolv Protocol SolvBTC (SOLVBTC) $ 62,334.00
  • based-brettBrett (BRETT) $ 0.110405
  • jupiter-exchange-solanaJupiter (JUP) $ 0.794846
  • heliumHelium (HNT) $ 6.26
  • ondo-financeOndo (ONDO) $ 0.712878
  • algorandAlgorand (ALGO) $ 0.120731
  • ethenaEthena (ENA) $ 0.358419
  • matic-networkPolygon (MATIC) $ 0.365351
  • kucoin-sharesKuCoin (KCS) $ 8.13
  • quant-networkQuant (QNT) $ 64.97
  • lido-daoLido DAO (LDO) $ 1.05
  • jasmycoinJasmyCoin (JASMY) $ 0.018888
  • bitcoin-svBitcoin SV (BSV) $ 45.02
  • aerodrome-financeAerodrome Finance (AERO) $ 1.35
  • bittorrentBitTorrent (BTT) $ 0.00000091
  • galaGALA (GALA) $ 0.021785
  • neiro-3Neiro (NEIRO) $ 0.002015
  • spx6900SPX6900 (SPX) $ 0.909228
  • fasttokenFasttoken (FTN) $ 2.56
  • coredaoorgCore (CORE) $ 0.915705
  • flowFlow (FLOW) $ 0.539774
  • ether-fi-staked-ethether.fi Staked ETH (EETH) $ 2,450.30
  • wormholeWormhole (W) $ 0.305681
  • notcoinNotcoin (NOT) $ 0.007951
  • starknetStarknet (STRK) $ 0.419326
  • renzo-restaked-ethRenzo Restaked ETH (EZETH) $ 2,507.98
  • beam-2Beam (BEAM) $ 0.015118
  • msolMarinade Staked SOL (MSOL) $ 180.88
  • conflux-tokenConflux (CFX) $ 0.167405
  • mog-coinMog Coin (MOG) $ 0.000002
  • usddUSDD (USDD) $ 0.997139
  • klay-tokenKlaytn (KLAY) $ 0.127419
  • ordinalsORDI (ORDI) $ 35.23
  • elrond-erd-2MultiversX (EGLD) $ 26.75
  • neoNEO (NEO) $ 10.35
  • flare-networksFlare (FLR) $ 0.014478
  • eosEOS (EOS) $ 0.471050
  • axie-infinityAxie Infinity (AXS) $ 4.65
  • mina-protocolMina Protocol (MINA) $ 0.602522
  • tezosTezos (XTZ) $ 0.687474
  • chilizChiliz (CHZ) $ 0.075198
  • tokenize-xchangeTokenize Xchange (TKX) $ 8.55
  • paypal-usdPayPal USD (PYUSD) $ 0.999957
  • nervos-networkNervos Network (CKB) $ 0.014938
  • ecasheCash (XEC) $ 0.000034
  • eigenlayerEigenlayer (EIGEN) $ 3.54
  • tether-goldTether Gold (XAUT) $ 2,650.71
  • pendlePendle (PENDLE) $ 4.04
  • fraxFrax (FRAX) $ 0.996997
  • axelarAxelar (AXL) $ 0.793417
  • arbitrum-bridged-wbtc-arbitrum-oneArbitrum Bridged WBTC (Arbitrum One) (WBTC) $ 62,556.00
  • the-sandboxThe Sandbox (SAND) $ 0.260981
  • turboTurbo (TURBO) $ 0.008884
  • akash-networkAkash Network (AKT) $ 2.44
  • dydx-chaindYdX (DYDX) $ 0.930294
  • kelp-dao-restaked-ethKelp DAO Restaked ETH (RSETH) $ 2,520.21
  • cat-in-a-dogs-worldcat in a dogs world (MEW) $ 0.006733
  • sats-ordinalsSATS (Ordinals) (SATS) $ 0.00000028
  • aleoALEO (ALEO) $ 2.75
  • ethereum-name-serviceEthereum Name Service (ENS) $ 16.97
  • roninRonin (RON) $ 1.58
  • superfarmSuperVerse (SUPER) $ 1.23
  • nexoNEXO (NEXO) $ 0.991513
  • decentralandDecentraland (MANA) $ 0.293883
  • book-of-memeBOOK OF MEME (BOME) $ 0.007814
  • zcashZcash (ZEC) $ 35.46
  • lombard-staked-btcLombard Staked BTC (LBTC) $ 62,610.00
  • dog-go-to-the-moon-runeDOG•GO•TO•THE•MOON (Runes) (DOG) $ 0.005373
  • arbitrum-bridged-weth-arbitrum-oneArbitrum Bridged WETH (Arbitrum One) (WETH) $ 2,458.04
  • pax-goldPAX Gold (PAXG) $ 2,662.42
  • l2-standard-bridged-weth-baseL2 Standard Bridged WETH (Base) (WETH) $ 2,459.48
  • pancakeswap-tokenPancakeSwap (CAKE) $ 1.82
  • beldexBeldex (BDX) $ 0.075944
  • jupiter-staked-solJupiter Staked SOL (JUPSOL) $ 154.17
  • arkhamArkham (ARKM) $ 1.81
  • aioz-networkAIOZ Network (AIOZ) $ 0.445301
  • coinbase-wrapped-staked-ethCoinbase Wrapped Staked ETH (CBETH) $ 2,655.85
  • terra-lunaTerra Luna Classic (LUNC) $ 0.000087
  • true-usdTrueUSD (TUSD) $ 0.997888
  • blurBlur (BLUR) $ 0.254590
  • apecoinApeCoin (APE) $ 0.724939
  • dexeDeXe (DEXE) $ 8.51
  • raydiumRaydium (RAY) $ 1.82
  • zksyncZKsync (ZK) $ 0.130016
  • havvenSynthetix Network (SNX) $ 1.45
  • oasis-networkOasis (ROSE) $ 0.070437
  • safeSafe (SAFE) $ 0.958968
  • trust-wallet-tokenTrust Wallet (TWT) $ 1.12
  • gigachad-2Gigachad (GIGA) $ 0.048668
  • baby-doge-coinBaby Doge Coin (BABYDOGE) $ 0.00000000
  • gnosisGnosis (GNO) $ 174.38
  • layerzeroLayerZero (ZRO) $ 3.95
  • bridged-usdc-polygon-pos-bridgeBridged USDC (Polygon PoS Bridge) (USDC.E) $ 0.999957
  • astarAstar (ASTR) $ 0.059388
  • celoCelo (CELO) $ 0.795915
  • iotaIOTA (IOTA) $ 0.125115
  • livepeerLivepeer (LPT) $ 12.10
  • dydxdYdX (ETHDYDX) $ 0.929525
  • xdce-crowd-saleXDC Network (XDC) $ 0.028200
  • frax-etherFrax Ether (FRXETH) $ 2,451.48
  • metaplexMetaplex (MPLX) $ 0.423118
  • apenftAPENFT (NFT) $ 0.00000042
  • dogs-2Dogs (DOGS) $ 0.000787
  • usdbUSDB (USDB) $ 1.00
  • theta-fuelTheta Fuel (TFUEL) $ 0.060387
  • l2-standard-bridged-weth-blastL2 Standard Bridged WETH (Blast) (WETH) $ 2,458.15
  • super-oethSuper OETH (SUPEROETHB) $ 2,455.12
  • coinbase-wrapped-btcCoinbase Wrapped BTC (CBBTC) $ 62,589.00
  • constitutiondaoConstitutionDAO (PEOPLE) $ 0.078022
  • compound-governance-tokenCompound (COMP) $ 44.39
  • echelon-primeEchelon Prime (PRIME) $ 8.00
  • bitcoin-goldBitcoin Gold (BTG) $ 21.74
  • iotexIoTeX (IOTX) $ 0.040037
  • ondo-us-dollar-yieldOndo US Dollar Yield (USDY) $ 1.05
  • osmosisOsmosis (OSMO) $ 0.544435
  • stepnGMT (GMT) $ 0.128617
  • ethereum-pow-iouEthereumPoW (ETHW) $ 3.45
  • kavaKava (KAVA) $ 0.340951
  • binance-peg-busdBinance-Peg BUSD (BUSD) $ 0.998539
  • polygon-pos-bridged-weth-polygon-posPolygon PoS Bridged WETH (Polygon POS) (WETH) $ 2,454.47
  • dymensionDymension (DYM) $ 1.72
  • bitcoin-avalanche-bridged-btc-bBitcoin Avalanche Bridged (BTC.b) (BTC.B) $ 62,308.00
  • safepalSafePal (SFP) $ 0.707655
  • reserve-rights-tokenReserve Rights (RSR) $ 0.006495
  • harrypotterobamasonic10inHarryPotterObamaSonic10Inu (ETH) (BITCOIN) $ 0.335755
  • wemix-tokenWEMIX (WEMIX) $ 0.801248

Onyx Protocol Loses $3.8 Million in Preventable Hack

0 11

Onyx Protocol Loses $3.8 Million in Preventable Hack

  beincrypto.com  + 4 more 26 September 2024 15:31, UTC

Onyx Protocol Loses $3.8 Million in Preventable Hack

Onyx Protocol, a Compound Finance fork, suffered a $3.8 million loss on Thursday to mark another entry in a series of attacks as bad actors explore system vulnerability.

Cyber-attacks continue to plague the crypto industry, highlighting the need for enhanced security.

$3.8 Million Hack Hits Onyx Protocol

Blockchain security firm PeckShield highlighted suspicious transactions on OnyxDAO, drawing attention to a possible attack on the protocol. In a follow-up post, the on-chain detective revealed losses reaching $3.8 million, indicating that the hacker was already swapping the funds.

Onyx Protocol Loses $3.8 Million in Preventable Hack

Onyx Protocol Hack. Source: PeckShield

Web3 security firm Cyvers corroborated the incident, citing suspicious transactions involving OnyxDAO on the Ethereum blockchain. According to Cyvers, most of the loss was in VUSD stablecoin.

“Our system has detected a suspicious transaction involving OnyxDAO on the ETH chain! The total loss is around $3.2 million [at the time]. Most of the losses are in VUSD. Attacker currently holds 521 ETH ($1.36 million). The rest of the digital assets are not swapped yet,” Cyvers wrote.

Additional investigations by PeckShield revealed that the attacker capitalized on a known precision issue presented as a bug in the forked Compound V2 code base. They then siphoned 4.1 million VUSD, 7.35 million XCN, 5,000 DAI, 0.23 WBTC, and 50,000 USDT. Reportedly, the bug leveraged a nearly empty market to manipulate the exchange rate.

Notably, hackers used the same approach in October 2023, hacking the same protocol for $2.1 million. In the October incident, the vulnerability was a rounding error. At the time, researchers ascribed the vulnerability to Onyx Protocol being a fork of Compound Finance.

How the Code Vulnerability Occurs

With many DeFi protocols being open-source, developers tend to avoid the long approach. They opt to build off of an existing code as opposed to implementing functionality from scratch.

The approach is considered popular as it can improve efficiency and security when done correctly. The downside is that if the template code is not secure, the fork may inherit the vulnerabilities.

“In the case of the Onyx protocol, the Compound Finance code that it used had a known vulnerability that had already been exploited in Hundred Finance and Midas Capital, which also forked the Compound Finance code. However, the Onyx Protocol used the same code and lacked the community support and vigilance needed to prevent the vulnerability from being exploited,” security firm Halborn reported.

This means the Onyx Protocol hack could have been prevented, given the prevalence of rounding errors. Notably, guidance already exists when launching new markets on Compound Finance and its forks.

“At Hexagate, we recommend any Compound V2 fork, when launching new markets to mint some cTokens and burn them to make sure the total supply never goes to zero. When the total supply goes to zero, the protocol becomes vulnerable and this strategy mitigates this situation,” security firm Hexgate guided in April 2023.

These incidences, including a $4.6 million attack on decentralized infrastructure Truflation on Wednesday, reflect the prevalent challenge in the crypto industry, where bad actors use different mechanisms to steal digital assets.

Source

Leave A Reply

Your email address will not be published.