以太坊借贷平台 XCarnival确认的 一个坏人偷走了 380 万美元或 3,087 ETH。根据链上安全公司 Peck Shield 的一份报告，一名黑客通过借入 ETH 并创建“多次质押 BAYC（Bored Ape Yacht Club NFT）质押订单”来利用协议智能合约上的漏洞。
相关阅读 | 据称 Morgan Creek 正在竞标获得 250 亿美元以应对 FTX BlockFi 救助计划
XCarnival 作为不可替代代币 (NFT) 借贷池运作。该平台使 NFT 持有者能够存入他们的资产以换取流动性。这个过程涉及三个智能合约：一个 NFT 管理器、一个管理借贷限制的 P2Controller 和资金存储，作为陈述 由另一家安全公司 Go+ Security 提供。
黑客从 OpenSea 上流行的 Bored Ape Yacht Club NFT 系列中购买了商品 5110。随后，他将这笔资产存入了XCarnival，并进行了“使用同一个NFT进行借贷”的攻击。
换句话说，攻击者能够质押 NFT，借入 ETH，然后在不偿还贷款的情况下移除 NFT。坏人多次完成这个过程，直到池子被抽干。
Go+ Security 解释说，黑客创建了一个 Master 智能合约和几个“slave”智能合约来进行攻击：
然后 Slave 5338 撤回 NFT 并发回给 Master，Master 再与其他 Slave 重复这个过程。通过这种方式，他们创建了许多 orderID，这些 orderID 可以在以后用作借贷凭证。但是被窃听的 xNFT 合约在退出后并没有撤销凭证。
X嘉年华经营 如上所述，其智能合约存在漏洞，如果用户停留在某个范围内，则可以发起攻击。 Go+ Security 补充了攻击和智能合约漏洞：“抵押品在退出后仍然有效。这是一个非常简单的 &合同执行中的幼稚错误。”
鉴于攻击成功，基于以太坊的 NFT 借贷协议决定向黑客提供一笔交易。
根据其官方 Twitter 帐户，XCarnival 向黑客提供了 1,500 ETH 或 180 万美元的赏金。被盗资金的一半。攻击者只需要归还另一半，他们就可以保留这笔钱并且不会承担任何法律后果。
该平台背后的团队确认黑客同意这些条款。被盗资金的一半被返还到资金池中。以太坊借贷平台声称“安全机构已经初步确定了黑客的地理位置”。
该声明似乎暗示了攻击者可能面临的法律后果，但该项目背后的团队尚未提供更多信息。
7/8 退还资金https://t.co/oRwSsGgT6Upic.twitter.com/YgXZ9DTj03
— Tal Be'ery (@TalBeerySec)2022 年 6 月 27 日
这不是黑客第一次同意返还部分或全部被盗资金。一些黑客攻击去中心化金融 (DeFi) 平台，并经常扣押资金，直到他们收到他们认为是“服务”的付款。其他项目就没那么幸运了，付出了最终的代价。
相关阅读 | Harmony 悬赏 100 万美元以返还 1 亿美元被盗资金——够了吗？
在撰写本文时，以太坊 (ETH) 的交易价格为 1,180 美元，在过去 24 小时内下跌了 3%。
Amazon is using AI and machine learning to combat rising impersonation scams, especially during the holiday season. The company has successfully shut down thousands of phishing sites and phone numbers, but stresses the importance of collaboration with other industry players to fight fraud effectively.
AnaisOpenAI has launched a new search feature in ChatGPT, now available to all users, challenging Google’s dominance in the search engine market. The feature offers real-time information with web-sourced citations, marking a significant expansion for OpenAI in the AI-driven search space.
WeatherlyThe US Senate Banking Committee has cancelled Caroline Crenshaw’s renomination, ending her tenure as SEC commissioner. Known for her anti-crypto stance, Crenshaw opposed Bitcoin ETFs and pushed for stricter crypto oversight. While the crypto community celebrates, is the victory premature?
CatherineCrypto.com CEO Kris Marszalek met with President-elect Trump to discuss crypto appointments and Bitcoin reserves, as the exchange dropped its SEC lawsuit. Are more crypto-friendly appointments on the horizon?
KikyoBybit will end its services in France by 8 January 2025 due to strict regulations from the French Financial Markets Authority (AMF). Customers must withdraw funds before the deadline or transfer assets to Coinhouse, a licensed local custodian.
WeatherlyElon Musk accused Senator Elizabeth Warren of backing SBF’s parents, while Warren criticised his D.O.G.E involvement, citing conflicts of interest. Musk defended D.O.G.E, arguing it could curb inflation by cutting government waste. Is this political clash necessary, or just another distraction in crypto debates?
CatherineThe U.S. Treasury sanctioned two Chinese individuals and a UAE-based company for laundering cryptocurrency to fund North Korea’s weapons programmes. The crackdown aims to disrupt Pyongyang’s use of cybercrime and illicit financial networks to support its nuclear ambitions.
AnaisParody X account Richard E. Ptardio, gifted meme coins in his likeness, donated a significant portion to charity after his holdings peaked at $1 million, turning a viral moment into a meaningful gesture.
KikyoAI technology is increasingly being used in the anime industry, with projects like "Twins HinaHima" relying on AI for 95% of animation production. This has sparked debates about job losses, the potential loss of artistic integrity, and the environmental impact of AI systems.
AnaisPresident-elect Trump emphasized fair trade, vowing to impose reciprocal tariffs on nations like India and Brazil for their high duties on US goods.
Catherine