đ¨ Somethingâs gone wrong with Swellâs swETH/rswETH: The tokens werenât stolen outrightâtheir âexchange rateâ was manipulated
This morning, on-chain researcher Spreek sounded the alarm: The administrator-related keys for two liquid staking tokens under Swell DAO, swETH and rswETH, may have been compromised. Spreek also expressed uncertainty, speculating that it could be related to the Railway cloud platform incident over the past couple of days. Thereâs no confirmation yet.
Hereâs what we know so far:
đš The attacker is pushing up the NAV of the two tokens (how much ETH each token represents), by as much as 1% per hour, without any real ETH backing it
đš Four malicious upgrade contracts have been deployed on-chain. According to Spreek, they havenât yet been queued for execution through the multisig. If executed, they could drain around 2,500 ETH
đš Itâs been reported that Swell said no ETH has left the contracts so far
I think the key takeaway for most people is this âexchange rate manipulationâ technique.
The price of liquid staking tokens is often determined not by the market, but by an exchange rate reported by an oracle. Artificially inflating that rate could let someone use overvalued swETH as collateral in a lending protocol to borrow real assets, or trade it in a pool for more ETH. The parties who take the hit may not be Swell itself, but everyone who prices swETH using that rate.
Another thing to note is the multisig. The malicious contracts have been deployed, but are still stuck in the multisig process. Thatâs exactly why multisigs and timelocks exist: If the keys are lost, thereâs still one last line of defense. Whether a project has a timelock and how its signers are distributed may not get much attention in normal times, but during an incident, it can be a matter of life or death.
If you hold swETH/rswETH or related LP tokens:
đš Donât rush to âbuy the dipâ while information is unclearâthe exchange rate itself may be fake
đš Check which lending protocols youâve used it as collateral in
đš Follow announcements only from Swellâs official accounts. âCompensation claimsâ and âmigration linksâ that appear after an incident are usually phishing scams
From the PHP vulnerability to Railway and GitLab, more and more risks in crypto this week have come from Web2 infrastructure. If you hold staking tokens, do you know who reports their exchange rateâand who can change it?
#Swell #ćľĺ¨ć§č´¨ćź #éžä¸ĺŽĺ ¨ #ETH
This morning, on-chain researcher Spreek sounded the alarm: The administrator-related keys for two liquid staking tokens under Swell DAO, swETH and rswETH, may have been compromised. Spreek also expressed uncertainty, speculating that it could be related to the Railway cloud platform incident over the past couple of days. Thereâs no confirmation yet.
Hereâs what we know so far:
đš The attacker is pushing up the NAV of the two tokens (how much ETH each token represents), by as much as 1% per hour, without any real ETH backing it
đš Four malicious upgrade contracts have been deployed on-chain. According to Spreek, they havenât yet been queued for execution through the multisig. If executed, they could drain around 2,500 ETH
đš Itâs been reported that Swell said no ETH has left the contracts so far
I think the key takeaway for most people is this âexchange rate manipulationâ technique.
The price of liquid staking tokens is often determined not by the market, but by an exchange rate reported by an oracle. Artificially inflating that rate could let someone use overvalued swETH as collateral in a lending protocol to borrow real assets, or trade it in a pool for more ETH. The parties who take the hit may not be Swell itself, but everyone who prices swETH using that rate.
Another thing to note is the multisig. The malicious contracts have been deployed, but are still stuck in the multisig process. Thatâs exactly why multisigs and timelocks exist: If the keys are lost, thereâs still one last line of defense. Whether a project has a timelock and how its signers are distributed may not get much attention in normal times, but during an incident, it can be a matter of life or death.
If you hold swETH/rswETH or related LP tokens:
đš Donât rush to âbuy the dipâ while information is unclearâthe exchange rate itself may be fake
đš Check which lending protocols youâve used it as collateral in
đš Follow announcements only from Swellâs official accounts. âCompensation claimsâ and âmigration linksâ that appear after an incident are usually phishing scams
From the PHP vulnerability to Railway and GitLab, more and more risks in crypto this week have come from Web2 infrastructure. If you hold staking tokens, do you know who reports their exchange rateâand who can change it?
#Swell #ćľĺ¨ć§č´¨ćź #éžä¸ĺŽĺ ¨ #ETH