🕳️ Balancer Frontend Rekt

HashingBits | Week- 38

In brief ⚡

• Balancer had issued an urgent warning to stop using its web interface, as it had evidently been compromised by malicious actors who redirected the funds to themselves. Within 30 minutes of the tweeted warning, $240,000 had already been stolen.

• This was the second theft from Balancer in a month after it had warned of a critical vulnerability on August 22, and that vulnerability was exploited for around $2 million several days later.

  

---

Hacks and Scams⚠️

---

Balancer Frontend

Amount of Loss:  ~ $238k

Analysis

• Balancer, an Ethereum-based decentralized protocol, recently experienced a security incident involving a domain attack.

• The platform quickly regained control of its domain and assured users of its security.

• The incident was attributed to a social engineering attack on EuroDNS, the domain name registrar for .fi Top-level domains (TLDs).

• Hackers managed to steal approximately $240,000 during the attack, with the funds being sent to an Ethereum address.

• Balancer warned users not to interact with balancer.fi or app.balancer.fi until further notice.

• In response to the incident, Balancer was considering migrating to a more secure domain registrar.

• Balancer had previously suffered a significant loss of nearly $1 million on August 27 due to hackers exploiting a critical vulnerability in some of the protocol's V2 pools.

---

Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

---

Tweets

1. When using the Diamond Standard for upgradeable smart contracts, a very useful pattern is:

2.  Meet GothicShanon. He currently holds the #5 position on the Immunefi leaderboard and has made more than $2.8 million from bug-hunting.  Here’s his story. 👇(1/20)

3. Studying **Immunefi's #5** `GothicShannon89238`, will unlock in your brain beautiful attack vectors you never thought were possible and pay +$100k per report.

4. Web3 Security Checklists for Ethereum Smart Contract Development

5. 🔽Beosin's Research Series🔽

GitHub Repos

1. ✨Introducing Uni-LBP✨  A capital-efficient Uniswap v4 liquidity bootstrapping pool (LBP) hooks contract

Articles 

1. NFT attacks

2. Solidity layout and access of storage state variables simply explained

3. Market Manipulation vs. Oracle Exploits

4. 0Kage Diaries Chapter 1 — Enzyme Finance

5. How To Reproduce A Simple MEV Attack

6. Deconstructing the SLOAD opcode

---

Web3 Community Spotlight🔦

---

• This time, we covered blockchain reorganization with the help of analyzing a critical bug report by Pashov.
  Find out about

  • What is Blockchain Reorganization? 

  • Why does it happen?

  • How it can manifest itself as a critical bug?

👇

---

---

Thanks for reading HashingBits! Share a summary of our newsletter on your social media platforms, tag us, and use the #AwareToEarn hashtag, and you could win 10 USDT as a reward! Help us build a safer Web3 ecosystem and have a chance to earn rewards and support our work.

---