Rari Fuze hacker offered $10M bounty by Fei Protocol to return $80M loot

Decentralized finance (DeFi) platform Fei Protocol provided a $10 million bounty to hackers in an try to barter and retrieve a significant chunk of the stolen funds from varied Rari Fuse swimming pools value $79,348,385.61 — almost $80 million.

On Saturday, Fei Protocol knowledgeable its buyers about an exploit throughout quite a few Rari Capital Fuse swimming pools whereas requesting the hackers to return the stolen funds in opposition to a $10 million bounty and a “no questions requested” dedication.

Related articles

Hector Swap: A revolutionary DeFi swap aggregator

2023-04-13

Fantom: Though DeFi-friendly measures show results, FTM remains in limbo

2023-04-11

We’re conscious of an exploit on varied Rari Fuse swimming pools. We have now recognized the basis trigger and paused all borrowing to mitigate additional harm.

To the exploiter, please settle for a $10m bounty and no questions requested for those who return the remaining person funds.

— Fei Protocol (@feiprotocol) April 30, 2022

Whereas the precise losses from the exploit weren’t formally launched, DeFi investigator BlockSec’s monitoring system detected a lack of greater than $80 million — citing the basis trigger as a typical reentrancy vulnerability. Whereas reentrancy bugs have been the primary offender in lots of exploits throughout the DeFi ecosystem, the $80 million loot makes the Fei Protocol exploit one of many largest reentrancy hacks ever.

Upon additional investigations, Rari developer Jack Longarzo revealed a complete of six weak swimming pools (8, 18, 27, 127, 144, 146, 156) which were briefly paused whereas an inner repair is underway. On the time of writing, Rari’s inner and exterior safety engineers partnered with DeFi service supplier Compound Treasury to additional examine and neutralize the hack.

Offering additional insights into the event, blockchain investigator PeckShield narrowed down the exploit to a reentrancy bug, which permits hackers to make use of a perform and make exterior calls to a different untrusted contract.

The previous reentrancy bug bites once more on Compound forks w/ $80M loss! This time, it re-enters through exitMarket()!!! https://t.co/NpC8AAZRXc

Be careful, all Compound forks in EVM-compliant chains. Get in contact together with your auditors now or be happy to contact us if we will be of any assist pic.twitter.com/M9JElTWMSd

— PeckShield Inc. (@peckshield) April 30, 2022

Safety-focused rating platform CertiK informed Cointelegraph that the attacker has despatched 5400 Ether (ETH), or $15,298,900 on the time of writing, to Twister Money and nonetheless holds 22,672.97 ETH, or $64,245,245.43 on the time of writing, of their pockets. The assault has drained funds from the Rari pool whereas the Fei Swimming pools (Tribe, Curve) stay unaffected.

Final yr on Could 8, 2021, Rari Capital grew to become sufferer to a high-priced exploit that was associated to the mixing with Alpha Enterprise DAO, beforehand Alpha Finance Lab. On the time of writing, there have been no official bulletins from the Fei Protocol staff on the outcomes of their investigation.

Associated: Plan for $1M bug bounties and double the nodes in wake of $600M Ronin hack

Because the crypto group goes via an ever evolving battle in opposition to hackers, quite a few tasks and protocols have determined to amp up their safety measures. On Th, the Ronin Community and Sky Mavis revealed plans to improve their sensible contracts — following the $600 million hack within the earlier month.

We have now put collectively a postmortem relating to the Ronin exploit that occurred on March twenty third.

• Why it occurred
• What we’re doing to ensure this by no means occurs once more
• Ronin bridge re-opening replacehttps://t.co/FfwCtCG84E

— Ronin (@Ronin_Network) April 27, 2022

The US Federal Bureau of Investigation (FBI) attributed the assault to North Korea-based and state-sponsored hacking group Lazurus, because it fired off a warning to different crypto and blockchain organizations.