😦 HopeLend rekt for $835k

HashingBits | Week- 42

In brief ⚡

• Hack Drains Nearly All Assets from DeFi Protocol Hope Lend, Leaving It with Only $825,357 in Losses.

  

  ---

  Hacks and Scams⚠️

  ---

  HopeLend

  Amount of Loss:  ~ $835k

  Analysis

  • Ethereum DeFi protocol Hope Lend suffered a severe hack, resulting in the loss of almost all its assets.

  • On October 18, two individuals, including the original hacker and a frontrunner, stole a total of 526 Ether (ETH) from Hope Lend, valued at $825,357 at the time.

  • The successful attacker acquired 264 ETH and paid a 263 ETH bribe to an Ethereum validator, as reported by CertiK.

  • Hope.money, the developer of the DeFi protocol, presented a different perspective, claiming that a single hacker took 526 ETH worth of users' funds, paying 263.91 ETH in bribes to a validator associated with Lido Finance.

  • DeFi aggregator DefiLlama had recently started tracking Hope Lend's smart contracts for data curation, but at the time of the incident, Hope Lend had virtually no assets left within its protocol.

  • The hack may have been related to issues with WBTC (wrapped Bitcoin) decimals and rounding, similar to a previous Wise Lending hack. Hope.money assured users that other products and protocols on the platform, such as HopeCard and HopeSwap, were independent and unaffected.

  ---

  Explore the Depths of Knowledge: Research Papers, Blogs and Tweets🔖

  ---

  Tweets

  1. It’s been over a year since I’ve audited, but I hear a lot about “I don’t have time to write POCs”

  2.  I always suspected that my motivation and productivity would improve once I had autonomy and something I truly wanted to work on. 

  3. It took 97 hours of focused research over 12 days.

  4. I view auditing as nothing more.... 

  5. Need a quick refresher on read-only reentrancy? 🧐  Explore with me a real-world example of this attack vector found in Curve's steth pool.

  GitHub Repos

  1. Tips for Solidity Code Auditors 

  Articles 

  1. Secure integration with LayerZero

  2. DeFi Protection: Compensating Users For DeFi Losses

  3. There’s a new way to flip bits in DRAM, and it works against the latest defenses

  4. Security: The Infinite Game

  5.  EtherHiding: Hackers create novel way to hide malicious code in blockchains 

  ---

  Web3 Community Spotlight🔦

  ---

  Note - all the respective links has been embedded in the image

  Check out our latest AMA with 

  Jeffery Scholz - Founder of Rareskills

  

  Mudit Gupta - CISO of Polygon 

  

  Dr. Lei Wu - Co-founder of Blocksec

  

  ---

  

  ---

  Thanks for reading HashingBits! Share a summary of our newsletter on your social media platforms, tag us, and use the #AwareToEarn hashtag, and you could win 10 USDT as a reward! Help us build a safer Web3 ecosystem and have a chance to earn rewards and support our work.

  ---

  ---