Team Finance exploited for $14.5M during protocol migration despite contract audit

On Oct. 27, decentralized finance (DeFi) lockup protocol Group Finance said that over $14.5 million value of tokens had been exploited by means of the Uniswap v2 to v3 migration operate on its platform. As told by blockchain safety agency PeckShield, the hacker transferred liquidity from Uniswap v2 property on Group Finance to an attacker-controlled v3 pair with skewed pricing. By locking tokens to the contract, the attacker bypassed present validation mechanisms and pocketed the massive leftovers as a refund for revenue. 

Uniswap v3 was designed with higher effectivity for liquidity suppliers (LP) than v2 on its decentralized change. Nevertheless, v2 good contracts are nonetheless operational, and customers should work together with a migration good contract emigrate their LP property from v2 to v3. PeckShield estimated that the preliminary assault vector required for this interplay value simply 1.76 Ether (ETH).

Related articles

Hector Swap: A revolutionary DeFi swap aggregator

2023-04-13

Fantom: Though DeFi-friendly measures show results, FTM remains in limbo

2023-04-11

Drained property embody USD Coin (USDC), CAW, TSUKA and KNDA tokens, because the liquidity swimming pools had been “moved” to Uniswap v3. On the decentralized change, a few of the affected tokens, akin to CAW, suffered steep worth declines as a result of exploit and subsequent liquidity crunch. 

Group Finance mentioned that the good contract had been beforehand audited and urged the hacker to “get in touch with us for a bounty cost.” In consequence, builders have briefly paused all exercise on the protocol and declare that every one funds on the platform are usually not vulnerable to an additional exploit. Based in 2020, Group Finance and its father or mother agency, TrustSwap, present token liquidity locking and vesting companies for undertaking executives. The protocol claims to have $3 billion secured throughout 12 blockchains.

With vesting durations longer than Liz Truss’ employment historical past… https://t.co/1Wo6RwqsFg can preserve you safer than the British financial system this winter!

Lock your tokens as we speak and preserve the Truss away. pic.twitter.com/QYPhjg7HQo

— Group Finance (@TeamFinance_) October 21, 2022