Curve incident report: 4 pools caused a total of about $61.7 million in losses, the next step will be to stop the Gauge discharge to the affected pools

PANews reported on August 1 that Curve Finance officially reposted the post-event analysis of the exploit of the Curve pool reentry vulnerability released by the encryption risk assessment group LlamaRisk. The LlamaRisk report stated that a bug in an older version of the Vyper compiler caused a security feature used by a limited set of Curve pools to malfunction, allowing attackers to drain tokens from the affected pools as a result. While Curve is attempting to contact the exploiters and recover user funds, the exploitation of the bug directly harms the Curve liquidity providers of these affected pools. Thanks to the white hat hacker, the DAO has recovered some of the tokens in the affected pool. The Curve eDAO cannot suspend the Curve pool or process user funds in any way, but it can stop the discharge of the CRV Gauge (a term for Curve, meaning savings pool) to the Curve pool, and it is expected that the eDAO will eliminate the discharge of the gauge from all affected pools.

The affected pools and the amount of losses caused by this incident are: 1. pETH/ETH: 6106.65 WETH (about 11 million US dollars); 2, msETH/ETH: 866.55 WETH (about 1.6 million US dollars) and 959.71 WETH msETH (about $1.8 million); 3. alETH/ETH: 7258.70 WETH (about $13.6 million) and 4821.55alETH (about $9 million); 4. CRV/ETH: 7193,401.77 CRV (about 5.1 million USD), 7680.49 WETH (approximately 14.2 million USD) and 2879.65 ETH (approximately 5.4 million USD). In total, the aforementioned pools lost about $61.7 million.

The report also stated that the next immediate steps are to stop gauge discharge to the affected pools and create new normal pools for alETH, msETH, and pETH. New ETH pools should be paired with ETH or ETH pool implementations. CRV already has a new Tricrypto pool paired with crvUSD and ETH that is not affected by the reentrancy bug. The Curve team will continue to explore all avenues to recover user funds and will update the situation on social channels.

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Share
Comment
0/400
No comments
Trade Crypto Anywhere Anytime
qrCode
Scan to download Gate app
Community
English
  • 简体中文
  • English
  • Tiếng Việt
  • 繁體中文
  • Español
  • Русский
  • Français (Afrique)
  • Português (Portugal)
  • Bahasa Indonesia
  • 日本語
  • بالعربية
  • Українська
  • Português (Brasil)