Twitxy Saved

blockful.eth

Verified account This account is verified. Learn more

@blockful_io

Risk analysis and mechanism design to secure governance | @anticapture
Onchain blockful.io Joined June 2022
152 Following 1.5K Followers 1.7K Posts

Latest posts 5

Pinned post

blockful.eth Verified account @blockful_io
Most ENS just sits in wallets doing nothing.

The ENS Delegation Incentives Program changes that: delegate to an active delegate and you earn rewards from the ENS DAO while making ENS governance stronger.

And the more holders join, the bigger the reward pool gets for everyone.
🧵
1:03
2 replies 12 reposts 48 likes 23K views View on X
blockful.eth Verified account @blockful_io
@Enter_Elysium, an L2 built on Hyperliquid, officially launched yesterday. In just one day, it moved more than $45M. That's a small number compared to the volume @arc reached at launch ($435M), but it represents a new, living on-chain ecosystem.

One of the biggest winners of this launch was @Uniswap : more than 80% of DEX trading volume on Elysium went through Uniswap.

If the volume holds steady, Uniswap may consider turning on the fee switch on this new blockchain. On Arc, the DEX turned the fee on from its very first day, directly benefiting $UNI holders.

Data from @Adam_Tehc
blockful.eth Verified account @blockful_io
Yesterday, @ankr was attacked and $304K was stolen from the protocol. Ankr provides projects with infrastructure for liquid staking, RPCs, and bridges between equivalent assets.

The attack mainly targeted one of Ankr's bridges.

Like other bridges, Ankr's bridge verifies a user's deposit and locks the asset on one side, then releases the same amount on the other side. This is how a token moves from one network to another.

This verification is done by an off-chain signer controlled by Ankr: a service holding a private key that signs a "receipt" so the bridge contract can release funds on the other network.

Everything indicates that this signer was compromised. This allowed the hacker to submit 5 transactions requesting 82.9 ankrETH, 7.98 million ANKR, 515K ankrPOL, 5.4K aPOLb, and 0.82 aETHb.

In total, about $304K was stolen, according to SlowMist.

Regardless of how this key was secured, the way the bridge verified transactions was not safe: compromising a single signer was enough to compromise the whole bridge.

The bridge lacked a multisig or validation by multiple nodes to guarantee its integrity and security, which other projects already use.
SlowMist Verified account @SlowMist_Team 3d
🚨 SlowMist TI Alert 🚨

💸 @ankr Loss: ~$304.5k

🔍 Root Cause: The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and withdrawal amounts. All five receipts carried valid signatures from the bridge's trusted consensus signer, allowing withdraw() to release assets without independently verifying the receipts against the actual source-chain events.

⚠️ The origin of the unauthorized signatures remains under investigation. Signer compromise has not been confirmed.

📌 Attacker (Tx Sender): 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703
📌 Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6
📌 Vulnerable Contract: 0xc437DF90B37C1dB6657339E31BfE54627f0e7181

Powered by SlowMist.AI
Attack Tx:
etherscan.io/tx/0x7310af5d5…
etherscan.io/tx/0x90c563360…
etherscan.io/tx/0xde2d5b455…
etherscan.io/tx/0x91ba1a9c8…
etherscan.io/tx/0x46e20d4c8…

Reused Source Tx:
optimistic.etherscan.io/tx/0x02e805b51…
View quoted post on X
blockful.eth Verified account @blockful_io
@arbitrum is voting on whether to adopt USDG as its strategic priority and, to do so, will allocate 100M $ARB to incentivize its use.

The rationale for this adoption is to bring the DAO revenue that depends less on ETH volatility and network activity. According to the proposal, part of the yield generated by USDG will be shared with Arbitrum.

This would give the protocol an additional source of income. The exact amount isn't specified, but USDG generates a yield of 3.75% per year. For every $100M issued, that represents $3.75M - and a share of that would go to Arbitrum.

The 100M $ARB would be spent to incentivize USDG usage on Arbitrum. The more its supply expands on the network, the more revenue it generates for its issuer (Paxos) and for Arbitrum.

The proposal wasn't very well received in governance. It drew some criticism, such as:

- Incentive programs always attract mercenary capital. Once the incentives end, USDG supply may shrink again.
- It doesn't specify exactly how much revenue Arbitrum will earn from this partnership.
- There are no defined targets or gradual distribution of incentives: the 100M $ARB are distributed all at once.

The proposal has only reached 45% of the votes needed to meet quorum, meaning it hasn't been approved yet: it still needs 66M more votes in favor.
blockful.eth Verified account @blockful_io
Yesterday, @binance was hacked and $6.3B was stolen. It is already the largest heist in history.

After stealing the funds, the hacker deposited $60M in USDT on @aave and borrowed $44.6M in ETH from the protocol. The strategy is similar to the one used by the KelpDAO hacker earlier this year, but with a different goal.

The hacker swapped USDT, which Tether can freeze, for ETH, which no one can freeze. That way they “lose” $16M from the attack, but lower the risk of having the stolen funds frozen.

@LlamaRisk and other Aave risk managers froze all Aave v3 and v4 markets to stop the hacker from using other stolen tokens as collateral to borrow more from the protocol.

The situation is not as bad as the KelpDAO theft, because the collateral is USDT rather than some illiquid token. Still, this money will need to be returned to Binance at some point - and that may be a problem Aave has to deal with.
monetsupply.eth Verified account @MonetSupply Oct 29
looks like binance exploiter borrowed about 20,000 WETH against USDT collateral via @aave
View quoted post on X