The DeFi protocol Furucombo, designed to facilitate the processing of transactions within these spaces, was the victim of a recent exploit that robbed them of approximately $15 million.
The month of February closes with a new attack in DeFi. The victim is now the protocol furucombo, a DeFi optimization tool that allows users to streamline the processing of their batch transactions and also improve their strategies within the decentralized finance ecosystem. The developers of this protocol reported a recent exploit, executed by an attacker using a fake contract, which tricked the protocol into stealing funds worth approximately $15 million.
A couple of hours after discovering the attack, the Furucombo developers informed the crypto community of all the lost funds, ensuring that the vulnerability that the attacker managed to exploit has already been patched within the project, and that now the funds of Users are now safe.
At the time of detecting the attack, Furucombo had informed the community and requested that users revoke permissions and withdraw funds from the project as a precaution, to be protected from the attack. The 15 million dollars were extracted from the project using various ERC-20 tokens and ETH, the network's cryptocurrency Ethereum.
It may interest you: Yearn Finance is the victim of a million-dollar flash loan attack, but all is not lost
$63 million lost in DeFi attacks this month
This February, three DeFi protocols were victims of three attacks or exploits, in which large sums of money were lost, and which were reported due to the computer exploits carried out by their attackers. The first victim was Year Finance, the DeFi yield farming protocol, which saw an 11 million dollar exploit in your yDAI v1 performance vault. The attacker found a vulnerability within one of the Yearn Finance contracts, which he exploited using a series of transactions with cryptocurrencies, like ETH and stablecoins DAI (DAI), Tether (USDT) y USD Coin (USDC) within the dYdX, Compound and Curve protocols.
Less than a week after the attack on Yearn Finance, Alpha Finance It joined the list of DeFi protocols that were victims of these exploits. Although this protocol was also compromised via a flash loan, the attacker introduced a fake contract to extract value from one of Alpha's contracts that had not been publicly announced. The attacker managed to trick the protocol into believing that the fake contract was “his” and with this feat he manipulated and artificially inflated the protocol to extract 37 million.
furucombo is the third major victim this month, with a 15 million. The Furucombo attacker also used a fake contract to deceive and manipulate the protocol. According to reports Igor Igamberdiev, research analyst at The Block Research, the fake contract led Furucombo to believe it was a new implementation of the Aave V2 protocol, letting the attacker access the protocol and make multiple token transfers, which were approved to an arbitration address .
As Igamberdiev explains, the funds were mined in multiple tokens, such as: DAI, USDC, USDT, aAAVE, wBTC, LINK, cETH, COMBO, sETH, and more.
Mitigation plan
The Furucombo team claimed to be working on a mitigation plan to repair the damage that the exploit caused to the project's users. Meanwhile, the crypto community is questioning the effectiveness and veracity of audit and review projects, and the bug bounty programs that these protocols implement to encourage their security and that of their users.
The first DeFi project to report a fake contract exploit was pickle finance in November of the year; and it appears that these types of attacks are becoming increasingly common within the decentralized finance space.
Continue reading: Hack on Pickle Finance, another DeFi project that falls to hackers
