Partnered With:

Furucombo announced the progress of the investigation into the attack and said it would compensate users for asset losses

Read this article in 6 Minutes

The breach cost 22 Furucombo users $15 million in lost assets

On February 28, Furucombo, the composable Defi platform, was hacked, resulting in a $15m loss. On March 1, the Furucombo team gave a detailed explanation of how the attack happened, saying that user funds were safe and hackers could not attack them in the same way again, and that they would compensate users for the loss of assets.

What happened?

On February 27, 2021 at 4:47 p.m. UTC, Furucombo was attacked, and the team quickly discovered the problem and disabled the contract. Furucombo worked closely with security team Dedaub, as well as another well-known security expert, to ensure that no other user's money was lost.

Who is affected?

The breach caused 22 Furucombo users to lose assets (including 21 tokens, totaling $15 million), and measures are being taken to compensate the users.

Next step

· Furucombo will continue to work with the security team to monitor hackers;

· The Furucombo contract is now safe to use and the agent and registration contract will be upgraded to resolve the loan pool integration issue as soon as possible. AVE V2 Cube has returned to normal after a full test this week;

· Furucombo will continue to cooperate with the local police in investigating the hacking and does not rule out taking legal action;

· In 2021, Furucombo will undergo multiple external reviews.

Compensation for victims

Details of the compensation measures will be announced soon. We are actively communicating with affected users to ensure that assets are compensated.

The technique of the attack is repeated

Furucombo is based on a variety of components, with the proxy contract being the primary scheduling switch, allowing any number of components to be called in the same storage space. Such calls can be made through an external service, such as an AVE lightning loan.

The contract that allows the invocation of the agent (the caller), along with the contract that allows the agent (the called), is registered in the registration contract, which authorizes any such invocation.

The proxy contract unifies the caller and the called: the same call is used to verify "who is calling in the Furucombo proxy" and "who is calling in the Furucombo proxy" simultaneously. This allows the AVE's loan pool contract to delegate calls: the AVE contract is both a valid caller and a valid called party.

Scalability through the agent call Aave V2 lending pool, the proxy implementation in 0 x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc attacker calls Aave V2 lending pool agency contract, and requires its initialization attack agreement. Since the storage location of "implementation" is the storage location of Furucombo's agent contract, and the content is 0, the initialization is successful.

This then allows the attacker to invoke the attacker's implementation contract using the AVE V2 credit pool proxy to the delegate, which also successfully drains the user assets that allow the Furucombo proxy.