A GitHub repository named sol-live, presented as a Solidity interview practice project, was found to contain a backdoor that steals browser data, wallet extension storage, macOS Keychain files, and clipboard contents. The backdoor is triggered by malicious VS Code workspace terminal configurations. While the analysis did not confirm plaintext password decryption or data exfiltration, the potential for significant data compromise exists.
A Proof of Concept (PoC) details a reserve manipulation exploit in CrowdRingCircle's sell-destroy mechanism on BSC, which drained approximately 201.36K USDT.
A Proof of Concept (PoC) indicates an unguarded funding-growth update in Perpetual Protocol v2 (Curie) on Optimism drained a vault of approximately 3,062.21 USDC.
An exploit on MALT on the Polygon network resulted in the draining of approximately 13,440 DAI from the Capital Source treasury. The exploit involved unisolated treasury rebalance capital, allowing a negligible swap to yield a disproportionate MALT output.
A Proof of Concept (PoC) for a Pancake V3 swap-helper exploit has been added, detailing a signed delta bug that drained approximately 1.65 BNB on the BNB Chain.
An exploit on PositionManager on the BNB Chain resulted in the loss of approximately 32,080 USDT. The attack involved inflating share prices by manipulating the spot price of USDT/BTCB before depositing, allowing for the draining of the vault's own PancakeSwap V3 position.
An exploit PoC for AllbridgeCCTP details a phantom deposit vulnerability via unverified CCTP message attestation, leading to an estimated loss of $189.75K USDC on Base.
An exploit PoC for EnjinCryptoItems has been added, detailing an unprotected registry reinitialization that leads to manager takeover and a loss of 5.23M ENJ on Ethereum.
An attacker exploited a permissionless function in DAOstack's newOrganization to hijack an existing Reputation contract. The attacker drained the Genesis Alpha treasury, which held 4.025 ETH, by minting 20,000 REP and gaining full control.
An exploit on YamFinance involved a dormant DAO quorum governance takeover, draining legacy UMA farming contracts. The estimated loss is approximately $121K, consisting of WETH and UMA tokens.
A proof-of-concept exploit for GDC has been detailed, involving a chained EOA bypass, liquidity misclassification, burn mismatch, and a reentrant tax-free exit on BNB Chain, resulting in a loss of approximately 35.34 BNB.
An exploit Proof of Concept (PoC) for UnifiProtocol has been published, detailing how an unregistered caller-supplied pool was trusted for reward eligibility and math, leading to potential exploits.
Spark protocol is proposing several changes across Ethereum and Gnosis Chain, including offboarding unused integrations, deprecating LBTC as collateral, and fully deprecating SparkLend on Gnosis Chain by setting LTV and liquidation thresholds to 0%. These changes aim to reduce exposure and consolidate revenue, with some actions requiring governance polls and others falling under existing risk parameter modification authorities.
