A new flaw exploited in DeFi – The decentralized finance (DeFi) is a growing ecosystem. Nevertheless, this ecosystem is plagued by hacks. A new platform has just found out the hard way. In effect, Team Finance was the target of a hack that resulted in the loss of 15.8 million dollars.
Team Finance in the club of hacked DeFi protocols
TrustSwap is a decentralized finance project that offers various services to its users. On the one hand, we find TrustSwap which offers an exchange platform, a launchpad and a staking service. On the other, we find Team Financeanother TrustSwap-related entity that offers a service allowing to block tokens.
“Team Finance allows custom token release schedules to be set, for teams and token holders. »
Although the protocol looks like “the industry leader in security and project automation”, Team Finance was the target of an attack. It all started on October 27, shortly after 11 p.m., when Team Finance teams alerted their users that an attack was underway on the protocol.
“We have just been alerted to an exploit [une attaque réussie] on TeamFinance. We are not yet sure of the details. However, we invite the attacker to contact us for the payment of a bounty. We are working to analyze and remedy the situation at this very moment. »
Statement from Team Finance
At the same time, the first details were presented regarding the attack. It seems that the attacker managed to steal 15.8 million dollars taking advantage of a fault present in the migration contracts.
>> Yields on your cryptos even in complete safety, it’s on AscendEX (commercial link) <<
In the aftermath of the attack, we now have more details regarding the modus operandi used by the attacker.
As we have seen previously, this took advantage of a fault present in a contract allowing users to migrate their position of Uniswap V2 vers Uniswap V3. As explained by the PeckShield company, the attacker managed to trick the protocol and migrate the liquidity to a new Uniswap v3 pair that he controlled:
“The protocol features a flawed migrate() function that was exploited to transfer real-world liquidity from Uniswap V2 to a new attacker-controlled and price-distorted V3 pair, resulting in a huge balance as a refund. Also, authorized sender verification was bypassed by locking all tokens. »
At first, the attacker managed to bypass validations by locking the tokens into the contract.
The attacker was then able to call the migrate() function by passing it a wrong price. This allowed him to trigger a refund function which itself makes it possible to recover the surplus generated by the modification of the price.
In total, the attacker stole $15.8 million from 4 different pools :
- $11.5 million on CAW ;
- $1.7 million on CUT ;
- $700,000 on KNDX ;
- $1.9 million on FEG.
Even more surprising: the striker led his charge with only $2,700 entry. After the attack, he had multiplied by 5,851 his starting bet.
Negotiations underway to recover lost funds
Obviously, it is complicated for Team Finance teams to recover from this attack. To start, the teams quickly paused the protocol. In addition, they contacted the various exchange platforms with the aim of intercepting the funds if the attacker were to send them there.
At the same time, Team Finance has also undertaken negotiations with the hacker. Indeed, those responsible for the protocol sent him a message on the blockchain, proposing a reward in exchange for the return of funds.
” Hello ! Here, Ivan Reif (CTO of TrustSwap). If you decide to return the funds, we’ll reward you with a nice bonus (no questions asked) or a job offer. In the meantime, we have alerted most exchanges to this address and funds. Let’s work together for a better DeFi future! »
For the moment the attacker has not yet answered attempts at negotiations.
Let’s hope for Team Finance that the attacker responds positively to their proposal. If so, Team Finance might follow the Transit Finance protocolwho has successful to negotiate the return of funds with his attacker.
Do hacks and scams worry you? Do not wait to invest in cryptocurrency serenely and safely. Go register on the AscendEX platform ! Plus you get bold returns with AscendEX Earn (commercial link).
