🛡️ One missing input check drained 77 vaults in a day
I’ve seen this happen far too many times.
During the DeFi frenzy of summer 2020, the contracts that got exploited were always the ones where “the code was missing one check.”
On November 8, ACryptoS was attacked.
SlowMist recorded losses of about $665,000, affecting 77 vaults across five chains: Arbitrum, BNB Chain, Polygon, Base, and Optimism.
According to reports, the cause was a missing input validation in a multi-token deposit function:
The attacker entered an amount for only one token in a dual-token vault, skewed the share calculation, then used the extra shares to redeem both assets.
The most insidious part:
The number of shares in your wallet doesn’t change, so you can’t tell that the pool has already been drained.
Keep these three ground rules in mind:
• When the same code is deployed across multiple chains, if one chain is hit, it’s only a matter of time before the others are targeted
• Try a small amount first; don’t go all-in on a new vault
• Revoke approvals once you’re done using them; don’t let contracts retain access to your tokens
The more attractive a vault’s yield looks, the more important it is to ask: Who audited it, and have you read the audit report?
How many outstanding approvals are still linked to your wallet?
#Web3安全 #BNBChain $BNB
Not investment advice. DYOR.
I’ve seen this happen far too many times.
During the DeFi frenzy of summer 2020, the contracts that got exploited were always the ones where “the code was missing one check.”
On November 8, ACryptoS was attacked.
SlowMist recorded losses of about $665,000, affecting 77 vaults across five chains: Arbitrum, BNB Chain, Polygon, Base, and Optimism.
According to reports, the cause was a missing input validation in a multi-token deposit function:
The attacker entered an amount for only one token in a dual-token vault, skewed the share calculation, then used the extra shares to redeem both assets.
The most insidious part:
The number of shares in your wallet doesn’t change, so you can’t tell that the pool has already been drained.
Keep these three ground rules in mind:
• When the same code is deployed across multiple chains, if one chain is hit, it’s only a matter of time before the others are targeted
• Try a small amount first; don’t go all-in on a new vault
• Revoke approvals once you’re done using them; don’t let contracts retain access to your tokens
The more attractive a vault’s yield looks, the more important it is to ask: Who audited it, and have you read the audit report?
How many outstanding approvals are still linked to your wallet?
#Web3安全 #BNBChain $BNB
Not investment advice. DYOR.