慢雾:yearn遭遇攻击的根本原因是Yearn yETH加权稳定币交换池合约存在不安全的数学运算

GateNews

金色财经报道,据SlowMist监测,12 月 1 日,去中心化金融协议yearn遭遇黑客攻击,造成约 900 万美元损失。慢雾安全团队对该事件进行了分析,确认根本原因如下: 漏洞源于Yearn yETH加权稳定币交换池(Weighted Stableswap Pool)合约中用于计算供应量的 calcsupply 函数逻辑。由于存在不安全的数学运算,该函数在计算过程中允许溢出和舍入误差,导致新供应量与虚拟余额的乘积计算出现显著偏差。攻击者利用此缺陷可将流动性操控至特定数值,并超额铸造流动性池(LP)代币,从而非法获利。 建议加强边界场景测试,并采用经过安全验证的算术运算机制,以防范同类协议中此类溢出等高危漏洞。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Commento
0/400
Nessun commento