In April, our vulnerability detection system discovered an issue in the rBPF of Solana (i.e., the virtual machine where all the Solana dApps are running on: https://github.com/solana-labs/rbpf). After a careful investigation, we found that it is a security vulnerability that can lead to a wrong execution path of a contract…

The Mirror Protocol was reported by @FatMan to have been exploited. The blog has a good report on this. In this blog, we will use the attack transaction to elaborate how the attack happened. Disclaimer: This article is based on the public transaction and our understanding of the Mirror protocol…

By BlockSec On May 15th, 2022 at approximately 8:20 PM (UTC), our monitoring system detected that the FEGexPRO contract of the FEGtoken project was hacked. The attacker launched a series of attacks on both ETH and BSC mainnet and the total value involved accumulated to about $1.3m …

Started at March-23–2022 16:20:08 UTC+8, CashioApp was exploited to drain the collateral token account at the loss about 52 millions. The hack was made possible due to the insufficient check of input accounts that allows the attacker to mint 20 billion $CASH tokens without any deposit. …

By BlockSec On April 30th 2022, an attacker exploited the same vulnerability in the Nerve Bridge Incident to attack the Saddle Finance. In total, 4,900 Ether were under attack. Fortunately, 1,360 Ether of them were successfully saved by us. …

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs Secure the Solana Ecosystem (3) — Program Upgrade Secure the Solana Ecosystem (4) — Account Validation Secure the Solana Ecosystem (5) — Multi-Sig Secure the Solana Ecosystem (6) — Multi-Sig2 1. Overview In the previous…

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs Secure the Solana Ecosystem (3) — Program Upgrade Secure the Solana Ecosystem (4) — Account Validation Secure the Solana Ecosystem (5) — Multi-Sig 1. Overview In the previous post, we discussed the implementation of the…

We find there exist two serious logic vulnerabilities in the @AkuDreams contracts(https://etherscan.io/address/0xf42c318dbfbaab0eee040279c6a2588fa01a961d). The first vulnerability can cause a DoS attack and the second vulnerability will make the project fund (more than 34M USD) being locked forever. Vulnerability I

The Association NFT is a NBA launched NFT. However, we find the NFT sale contract has a serious vulnerability which allows an attacker to mint a large number NFTs, without paying any Tokens. The root cause of the vulnerability is the incorrect use of signature verification. Basically, the contract fails…