8 months ago
44 ARTICLE AD
ParaSwap, a decentralized finance aggregator, has started returning crypto to users after fixing a critical vulnerability in its Augustus v6 smart contract identified last week.
The smart contract bug emerged shortly after the contract’s introduction on March 18, aimed at improving swapping efficiency and reducing gas fees. However, the contract contained a critical vulnerability, allowing hackers to drain funds when approved.
The ParaSwap team reported on X on March 24 that all assets recovered by white hat hackers had been returned, and permissions to AugustusV6 were revoked.
White hack recovery update: Assets have been returned to wallets which have revoked their permissions
If your wallet had assets transferred to 0x66e90d840d7c4f3473e25dd8ca361747058c6db0 and have not received them yet, your wallet is still vulnerable, PLEASE REVOKE ALL RELEVANT… https://t.co/zraj3tSFNe
The team further noted that 213 addresses have yet to revoke their allowances to the compromised contract.
Revocation of a smart contract generally involves discontinuing or disabling its blockchain operations, which effectively hinders the contract’s capability to retrieve the user’s wallet and tokens.
The vulnerability was first discovered on March 20, with the platform responding by pausing its application programming interface (API) and securing at-risk funds through a white hat hack. The involvement of white hat hackers helped avert massive asset loss.
ParaSwap has since been proactive in addressing the aftermath of the security breach, submitting a detailed report to the relevant authorities to facilitate the investigation of the stolen funds.
Dear ParaSwap community, we are sharing an update on the recent actions taken regarding the V6 vulnerability.
1) We've taken the first step by submitting a comprehensive report to the appropriate authorities, kickstarting the investigation into the stolen funds.
2)…
“Actively engaged in identifying hacker addresses and tracing the movement of the funds,” ParaSwap states in close collaboration with blockchain analytics and security firms Chainalysis and TRM Labs.
The group also said that they had started talking to the hackers through on-chain messages and urged them to return the stolen user funds.
If there’s no response by March 27, ParaSwap plans to pursue recovery through legal means.
At the time, the losses were allegedly minor, with preliminary data suggesting that the hackers got away with just $24,000 before the vulnerability was identified.
The security of blockchain and DeFi platforms remains hard, as seen by previous breaches outside ParaSwap.
On Feb. 29, Shido’s layer-1 blockchain suffered a security breach, causing its token value to plummet over 90% within 30 minutes. The exploit, reported by PeckShield on X, resulted in the theft of over 4.3 billion Shido tokens, nearly half of its circulating supply.
Another significant security flaw was exploited earlier on Dec. 8, targeting the TIME token and leading to a $188k loss. It involved manipulating the Forwarder contract to execute transactions from a falsified sender address, deceiving the contract’s verification process.
