Started at March-23–2022 16:20:08 UTC+8, CashioApp was exploited to drain the collateral token account at the loss about 52 millions. The hack was made possible due to the insufficient check of input accounts that allows the attacker to mint 20 billion $CASH tokens without any deposit. …

By BlockSec On April 30th 2022, an attacker exploited the same vulnerability in the Nerve Bridge Incident to attack the Saddle Finance. In total, 4,900 Ether were under attack. Fortunately, 1,360 Ether of them were successfully saved by us. The detailed description of this incident can be found from the…

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs Secure the Solana Ecosystem (3) — Program Upgrade Secure the Solana Ecosystem (4) — Account Validation Secure the Solana Ecosystem (5) — Multi-Sig Secure the Solana Ecosystem (6) — Multi-Sig2 1. Overview In the previous…

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs Secure the Solana Ecosystem (3) — Program Upgrade Secure the Solana Ecosystem (4) — Account Validation Secure the Solana Ecosystem (5) — Multi-Sig 1. Overview In the previous post, we discussed the implementation of the…

We find there exist two serious logic vulnerabilities in the @AkuDreams contracts(https://etherscan.io/address/0xf42c318dbfbaab0eee040279c6a2588fa01a961d). The first vulnerability can cause a DoS attack and the second vulnerability will make the project fund (more than 34M USD) being locked forever. Vulnerability I

The Association NFT is a NBA launched NFT. However, we find the NFT sale contract has a serious vulnerability which allows an attacker to mint a large number NFTs, without paying any Tokens. The root cause of the vulnerability is the incorrect use of signature verification. Basically, the contract fails…

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs Secure the Solana Ecosystem (3) — Program Upgrade Secure the Solana Ecosystem (4) — Account Validation 1. Overview In the previous blog, we discussed the account validation, which is important to access control, in Solana…

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs Secure the Solana Ecosystem (3) — Program Upgrade 1. Overview In the previous blog, we discussed how to upgrade a program. In this post, we will introduce the access control related problems, which is one…

By BlockSec Team On Jan 18th, our monitoring system detected an attack against the AnySwap project (aka Multichain). The vulnerability is due to the flawed anySwapOutUnderlyingWithPermit() function whose verification mechanism can be bypassed to withdraw the approved tokens. Although the project has adopted different approaches (e.g., sending transactions to the…