Key Points:
More than $1.4 million was lost in total.
The attacker used the Tornado Cash mixing protocol to send 1,100 ETH.
As PeckShield reported, the Rubic exchange was hacked, resulting in a $1.4 million loss. The attacker has currently sent 1100 ETH to Tornado Cash.
Rubic is a cross-chain DEX aggregator. Users can exchange native tokens via the RubicProxy contract’s routerCallNative function. Before redeeming, it will first check to see if the target Router of the needed call put in by the user is on the protocol’s white list.
According to PeckShield’s monitoring, the multi-chain exchange protocol was hacked, resulting in a loss of more than 1.4 million US dollars. The attacker sent 1,100 ETH to the Tornado Cash mixing protocol.
After analyzing the stolen process, the SlowMist security team concluded that the main cause of the attack was that the protocol incorrectly added USDC tokens to the Router whitelist, resulting in the theft of USDC tokens from users allowed to the RubicProxy contract.
The user-supplied target Router will be called only after the whitelist check, and the calling data will also be supplied by the user. Unfortunately, USDC coins have also been placed to the Rubic protocol’s Router whitelist, allowing any user to call USDC tokens randomly using the RubicProxy contract.
As a result, malevolent users exploit this issue by calling the USDC contract using the routerCallNative function and transferring USDC tokens from users allowed to the RubicProxy contract to the malicious user’s account via the transferFrom interface.
DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.
Join us to keep track of news: https://linktr.ee/coincu
Website: coincu.com
Chubbi
Coincu News
