Partnered With:

Chainswap Black Sunday, over 20 DEFI projects were stolen

Read this article in 7 Minutes

Chainswap, a cross-chain bridge project, has been hacked again. More than 20 project tokens have been stolen by hackers, and nearly 10 damaged project partners have issued a response

原文标题：《 DeFi 安全史的黑暗一天：Chainswap 跨链桥超 20 个项目被盗》

Author: Hu Tao

Original source: Chain Catcher

Chainswap, a cross-chain bridge project, was hacked again early this morning. More than 20 tokens used to deploy smart contracts on the bridge were stolen by hackers, making it one of the biggest security breaches in the history of DEFI.

According to information released many twitter users, the hacker address 0 xeda5066780de29d00dfb54581a707ef6f52d8113, since today morning stole in succession from Chainswap bridge across chain contracts to exceed 20 items tokens, Projects involved include ANTIMatter, CORRA, DAOVenture, FM Gallery, FEI Protocol, Fair Game, ROCKS, PERI Finance, STRONG, WorkQuest, and Dora Factory, UNIDO, Unifarm, Wilder Worlds, Nord Finance, Optionroom, Umbrella, Razor, Dafi Finance, OroPocket, Kwikswap, Vortex , Blank, Rai Finance, Sakeswap, etc.

According to Etherscan and BSCScan data, the hacker has so far made about $2.3 million from the sale of tokens, with hundreds of thousands of dollars worth of tokens remaining unsold. According to some of the project parties, this may be because the developers have locked down some of the stolen assets so that the hackers cannot sell them. For now, Chainswap has temporarily closed its cross-chain bridge.

According to Twitter user @Christoph Michel, each token has a proxy contract that is transferred across the chain. When the hacker calls the contract, he has to pay 0.005eth in _chargeFee. But there is no real authentication check, only one signature is required. The problem might be the _decreaseAuthQuota function, which reverts if the signer's quota has been completed that day. But everyone seems to be starting with default quotas. So an attacker would only need to sign a different address each time to get around this. The 'volume' parameter is then transmitted to the 'to' attacker address in the _receive function.

Affected by the incident, tokens of ASAP, DVG, Matter, NORD, DAFI, UMB, Razor, ROOM and other projects all saw a maximum drop of more than 40%. So far, nearly 10 affected project owners have responded on Twitter, with many of them preparing to issue new tokens.

The Chainswap project owner tweeted that all ASAP token holders and LPs have been snapshot and that 1:1 airdrops of new ASAP tokens will be made, including ASAP holders of the exchange platform.

According to a tweet from the project, the Chainswap hackers obtained 3.3 million Room tokens, but the team became aware of the hack before the hackers sold any tokens and decided to remove liquidity from Uniswap and Pancakeswap, To protect token holders and liquidity providers from hackers selling into pools of liquidity. Currently, the team is working on the on-chain log and will airdrop new tokens to Room holders in the future.

Antimatter tweeted that a snapshot has been taken of all Matter holders and LP, and a 1:1 airdrop of new Matter tokens will be made, including Matter holders of the exchange platform.

The Peri Finance project owner tweeted that due to the Chainwap breach, the team has withdrawn all liquidity from Uniswap and Pancakeswap, in order to prevent a hacker from selling his tokens and running out of liquidity.

As a result of the Chainswap cross-chain bridge attack, the hackers sold 200,000 DAFI, and the team will buy back the DAFI on the open market for six months, the DAFI project owner tweeted. At the same time, the project reminded communities to draw liquidity from Dex, such as Uniswap, as soon as possible.

"Please bear with the temporary fluctuation of RAI price on the trading platform, we are in constant contact with the Chainswap team and monitoring the situation," the project's owner tweeted.

The UniFarm project tweeted that Chainswap was under attack. "They have advised us to remove mobility, which we have already done on Uniswap and Pancake Swap, and we are asking the community to remove their mobility as well until this issue is resolved." The project also said it had locked down all of the hacker's UFarm tokens using developer rights, so the hacker could not sell them.

Hackers seized and sold 300,000 DVGs worth $40,000 due to the Chainswap attack, and the DAOVentures project will take snapshots to compensate affected DVG holders, the project's owner tweeted.

Chainswap said it had already repurchased a small amount of the affected tokens from the market and returned the contract wallet. The rest will be paid out in full by the Chainswap vault.

Earlier in April, Chainswap announced it had closed a $3 million strategic round of funding, Alameda Research, OK Block Dream Fund, NGC Ventures, Spark Digital Capital, Continue Capital, etc.