Smart Contract Audit | Security Monitoring | AML/CFT (KYA/KYT) | Crypto Investigation | @Phalcon_xyz @MetaSleuth @MetaDockTeam 👉TG: https://xitter.cf/t.co/owokTLanv5
Joined December 2020
- Tweets2.3K
- Following154
- Followers27.3K
- Likes1.4K
BlockSec retweeted
A few hours ago, a NEM liquidity pool on #BSC lost ~$820K in a price manipulation attack that exploited a flaw in the NEM token’s tax-settlement mechanism.
The vulnerability lay in _flushLpSellRecycle(), which calculated the burn amount using pendingLpSellRecycle and burned NEM directly from the liquidity pool’s balance. It then called sync() to update the reserves, allowing the pool’s NEM price to be manipulated.
The attack proceeded as follows:
1. Transferred NEM directly to the pool to simulate sells and increase pendingLpSellRecycle.
2. Invoked skim() to recover most of the transferred tokens, reducing the attack cost without reducing pendingLpSellRecycle.
3. Invoked flushLpSellRecycle() to burn NEM from the pool. The burn amount was calculated as 70% of the pending amount, subject to pool-balance caps. The subsequent sync() call reduced the recorded NEM reserve, increasing NEM’s price relative to USDT.
4. Repeated steps 1–3 to raise the price further, then swapped NEM for USDT to realize a profit.
Attack TX: app.blocksec.com/phalcon/exp…
BlockSec retweeted
🗓 Weekly Web3 Security Roundup | Oct 12 - Oct 18
🚨 Spotlight on 3 notable incidents | ~$3.87M lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
blocksec.com/blog/web3-secur…
BlockSec retweeted
. @arkham now limits free users to the latest 100 transactions, with 1500 USD per month for the subscription.
Looking for an alternative? Try MetaSleuthh for address intelligence, fund flow analysis, risk screening and monitoring.
metasleuth.io/
BlockSec retweeted
.@_Qubic_ was reportedly exploited due to weak wallet seed generation. The issue now appears to have been fixed: github.com/qubic/wallet/comm…
However, the vulnerability was reported as early as February and does not appear to have been properly addressed at the time. The current fix also appears to follow the recommendation in that report: replacing Math.random() with crypto.getRandomValues().
Reports affecting critical components such as wallet seed generation deserve timely attention and follow-up.
BlockSec retweeted
.@UNCX_token was exploited across multiple chains for ~$1.5M. The root cause was inconsistent accounting of _totalTokenShares between release() and cancel(). This variable tracks the total outstanding shares of all schedules for a token.
Specifically, after release(), a schedule with _depositedShares = D and schedule.released = R has only D − R shares remaining in _totalTokenShares. However, cancel() removes D − V, where V is the recalculated vestedShare.
This accounting assumption can be broken through a donation followed by a top-up, which increases schedule.totalAmount while minting very few new shares and pushes V below R. Consequently, D − V exceeds the schedule’s remaining D − R shares, causing cancel() to deduct shares already removed by release(). This reduces the shared _totalTokenShares denominator and inflates the payout from the schedule retained by the attacker.
The key attack steps are illustrated using this exploit transaction:
app.blocksec.com/phalcon/exp…
1. Set up three schedules: The attacker created schedules 5058, 5059, and 5060. They fully released 5059 and 5060 while retaining 5058 for the final withdrawal.
2. Donate: The attacker transferred tokens directly to the vesting contract, inflating the asset-per-share value without minting new shares.
3. Top up and cancel: The attacker topped up schedules 5059 and 5060 with future-vesting tokens. Due to the manipulated share price, the top-ups greatly increased schedule.totalAmount while minting very few new shares, pushing vestedShare below schedule.released. Cancelling the schedules then deducted previously released shares from _totalTokenShares again.
4. Extract profits: With _totalTokenShares artificially reduced, the attacker released schedule 5058 at an inflated redemption value and repaid the flash loan.
The attacker repeated this process to drain assets from the vulnerable contract.
UNCX Vesting V2: Security Incident Update
Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next.
1. Security measures and containment
We have implemented several measures to prevent further exploitation of the affected contracts:
> Introduced substantial flat fees exceeding 1,000 ETH per lock.
> Removed all clients and contract interactions that previously allowed these fees to be bypassed.
> Increased token fees to the maximum permitted by the Vesting V2 contracts (5%), making repeated vesting top-ups economically unviable.
These measures are designed to prevent further exploitation through the identified methods. While our investigation and monitoring remain ongoing, we firmly believe we have taken the necessary steps available to us to contain the incident.
2. Scope of the incident
As previously communicated, all LP lockers remain unaffected, across every protocol and chain supported by UNCX.
The incident is isolated to UNCX Vesting V2. Our legacy vesting contracts are also unaffected and have undergone additional checks and review.
The incident currently involves 10 tokens across 4 chains:
Ethereum (6): $pepecoin, $EDGEN, $ZC, $X, $LO0P, $PAAL
Base (1): $IMO
BNB Chain (1): $BTCLE
Robinhood Chain (2): $CASHCAT, $RKST
3. Next steps for affected projects and communities
We are already in contact with most of the affected teams, communities or individuals impacted.
We expect to share further guidance and next steps with affected teams this week.
We will also publish a comprehensive incident report covering the technical findings, financials, and the details of our proposed recovery plan.
Important: For all impacted tokens, we strongly advise against trading in the affected pools until further guidance is provided by the respective token teams. We will be coordinating directly with those teams over the coming days.
4. Investigation and recovery efforts
Our investigation remains active, and we are coordinating with law enforcement and @seal911.
To date, no funds have been returned by the attackers (primary and copycats) on any affected chain. We strongly encourage the responsible party to contact us directly to discuss a resolution.
We understand the seriousness of this incident for affected projects, holders, and communities.
Our immediate priorities remain preventing further exploitation, establishing the full extent of the impact, and working closely with affected teams toward a recovery plan.
We will continue to communicate when any meaningful updates become available.
Thank you for your patience.
The UNCX Team
BlockSec retweeted
🗓 Weekly Web3 Security Roundup | Oct 05 - Oct 11
🚨 Spotlight on 1 notable incident | ~$542K lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
blocksec.com/blog/web3-secur…
BlockSec retweeted
About 6 hours ago, ~$3.55M in unclaimed bridge funds was claimed and transferred out. Did the owner initiate the transactions, or did an attacker obtain valid EIP-7702 authorizations?
Several days earlier, stuckfunds.eth, an onchain researcher, had sent multiple messages to 0x4943, notifying the owner that the funds were still claimable. The claims were submitted by 0x24a9, an address funded via Tornado Cash, and executed through EIP-7702 delegations on the EOA.
Onchain data confirms that the authorizations were valid, but not whether the owner signed them intentionally, was tricked into signing them, or had the private key compromised.
TX1 ($1.33M): app.blocksec.com/phalcon/exp…
TX2 ($2.22M): app.blocksec.com/phalcon/exp…
BlockSec retweeted
🗓 BiWeekly Web3 Security Roundup | Sep 21 - Oct 04
🚨 Spotlight on 8 notable incidents | ~$418M lost these two weeks
Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
blocksec.com/blog/web3-secur…
BlockSec retweeted
NEAR Intents @near_intents suffered a ~$3.8M exploit due to a vulnerability affecting its deposit and withdrawal infrastructure. The attacker drained assets from a BNB Chain hot wallet, with the stolen funds subsequently routed through KuCoin and bridged to Bitcoin. NEAR Intents has patched the affected components and temporarily suspended deposits and withdrawals across 11 networks for security checks. The team has also announced a compensation plan to fully reimburse affected users.
Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.
The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full.
The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h.
Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma.
In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h).
The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.
BlockSec retweeted
.@payy_link was reportedly exploited, with estimated losses of $1.93M. Interestingly, the verifyRollup traces show several burn operations executed successfully with all-zero burn_hash values. How these zero hashes passed verification remains unclear; possible causes include a circuit flaw or a compromise of privileged infrastructure. The team has not yet responded publicly.
Attack TX1: app.blocksec.com/phalcon/exp…
Attack TX2:
app.blocksec.com/phalcon/exp…
BlockSec retweeted
🗓 Weekly Web3 Security Roundup | Sep 14 - Sep 20
🚨 Spotlight on 2 notable incidents | ~$11.3M lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
blocksec.com/blog/web3-secur…
BlockSec retweeted
🚨 ALERT! We have observed a series of attack transactions targeting contracts on #Ethereum, including those associated with @Fetch_ai, @nunet_global, and @SingularityNET. Total losses exceed $2.1 million.
The incidents appear to stem from leaked private keys belonging to two privileged accounts (e.g., the deployer account). By controlling these accounts, the attacker was able to execute authorized privileged operations and drain valuable assets through direct transfers or token minting.
The attacker appears to be actively probing potential victims, with @SingularityNET’s AGIX token being the latest target. Stay vigilant！
Compromised accounts:
etherscan.io/address/0x1572F…
etherscan.io/address/0x863F1…
BlockSec retweeted
.@nostrafinance was reportedly hit by a price-manipulation attack: approximately $3.5M was borrowed against NSTR collateral, though the final loss is not yet confirmed.
1. The attacker first created an NSTR/SolvBTC pool and added 1.5 SolvBTC as one-sided liquidity away from the active price: voyager.online/tx/0x741af6ef….
This increased the pool liquidity reported by GeckoTerminal, apparently influencing which pool supplied its Pragma NSTR price.
2. The attacker then added very little liquidity between the normal price and a much higher price; a small buy pushed the quote sharply upward: starkscan.co/tx/0x772e73613f….
At that point, Pragma had two contributing NSTR/USD prices: a normal AVNU quote of ~$0.00596118 (starkscan.co/tx/0x1d33ab3d3f…) and a manipulated GeckoTerminal quote of ~$99.02439975 (starkscan.co/tx/0x6bc9b41bce…).
Although the documentation describes a median of three sources, the second listed source did not provide a price in this instance. With only two available values, the median was their arithmetic average, approximately $49.51518, consistent with the borrow trace.
3. The attacker used another account holding NSTR collateral to borrow ETH, STRK, USDC, USDT, WBTC and DAIv1 at the inflated valuation: starkscan.co/v1/SN_MAIN/tx/0…
On September 17, a manipulated NSTR oracle price enabled one account to borrow approximately $3.5 million worth of ETH, STRK, USDC, USDT, WBTC and DAIv1 against NSTR collateral in the Nostra money market on Starknet.
The Nostra money market is paused: lending, borrowing, withdrawals and liquidations are currently unavailable. We are reconciling the impact on each asset and tracing the funds. The final loss and potential recoveries are not yet known.
We are working with relevant parties on recovery and will share verified updates, including a detailed post-mortem.
Beware of impersonators. Nostra will never DM you or ask you to connect a wallet as part of recovery.
Ongoing updates will be posted in our Discord.
BlockSec retweeted
🗓 Weekly Web3 Security Roundup | Sep 07 - Sep 13
🚨 Spotlight on 2 notable incidents | ~$320M lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
blocksec.com/blog/web3-secur…
BlockSec retweeted
ALERT! Our system detected an attack that drained ~$7.8M from a Gnosis Safe wallet on Ethereum (0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8).
The root cause was a flawed authorization check in the executor contract (0x4f0055926c839D1d960a82CBF84E2eE933958ebC). Setting the supplied contract parameter to address(this) passed validation, allowing attacker-controlled calls to execute from the trusted executor through an enabled Safe module.
The exploit moved ~2,900 aEthrsETH into a Uniswap V4 pool paired with the worthless “Permissionless Attacker Token” (PAT), leaving the Safe with a worthless LP NFT.
The original attack transaction was front-run by the MEV bot yoink, which captured ~2,882 rsETH (~$7.8M) and routed it to 0xC70f00CD7E461686b04B0E912E309becA8b80ea0.
Original attack TX: app.blocksec.com/phalcon/exp…
Front-run TX: app.blocksec.com/phalcon/exp…
BlockSec retweeted
🗓 Weekly Web3 Security Roundup | Aug 31 - Sep 06
🚨 Spotlight on 4 notable incidents | ~$9.4M lost this week
Featuring a vulnerability breakdown and in-depth analysis of selected key cases👇
blocksec.com/blog/web3-secur…
BlockSec retweeted
A cloud and web pentest stops where the money starts moving.
Signing → approval → fund logic → on-chain transactions — we test that chain adversarially, in an agreed scope, with evidence for every confirmed path.
Blockchain Penetration Testing, now live at BlockSec!
Start here👇
blocksec.com/blockchain-pene…
BlockSec retweeted
Shipping on BNB Chain? Security support just got easier to find.
The AvengerDAO marketplace brings together 11 security teams covering audits, threat monitoring, risk scanning and incident response:
@HashDit @CertiK @zokyo_io @salus_sec @Beosin_com @GoPlusSecurity @BlockSecTeam @pessimistic_io @sherlockdefi @getfailsafe @FirepanHQ
Explore the marketplace: avengerdao.org/marketplace
Learn how the AvengerDAO marketplace works in our blog 👇
bnbchain.org/en/blog/avenger…
BlockSec retweeted
1/x @Liquid_BTC Liquid Network appears to have experienced a consensus divergence at block 4,050,336. Approximately 13 minutes later, a 3,996.01834922 L-BTC peg-out was recorded on the branch that continued beyond the divergent block.
Our preliminary analysis, informed by the findings shared by @stutxo, suggests that a potential issue in the rangeproof-verification cache mechanism in certain Elements Core builds may have contributed to the incident:
xitter.cf/stutxo/status/20967245…
Previously, the cache key for successful rangeproof verifications was derived only from the rangeproof and value commitment. It did not include the asset commitment or scriptPubKey, although both are inputs to full verification.
This could allow different verification contexts to map to the same cache entry. After a valid context populated the cache, a modified context might hit that entry and return true without undergoing full verification.
A recent patch adds the missing inputs to the cache key:
github.com/ElementsProject/e…
If reachable during consensus validation, this behavior could cause nodes with different cache states or implementations to reach different conclusions about the same transaction.
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.
Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.
Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.
Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.
You can monitor the situation via @mempool's liquid.network site below:
mempool.space/address/bc1qdl…