VISR plunged nearly 95% after Uniswap V3 liquidity management protocol Visor Finance was hacked again

律动 BlockBeats 消息，12 月 22 日，Uniswap V3 流动性管理协议 Visor Finance 再次遭受黑客攻击，黑客借助漏洞提取了超过 880 万个 VISR 并在 Uniswap 上卖出，导致 VISR 代币暴跌近 95%，通过 Tornado Cash 进行洗币后黑客获利超过 120 枚 ETH。目前 Visor 官方表示将对攻击前地址数据进行快照，进行 VISR 代币迁移和退还。

据慢雾安全团队分析，Visor Finance 项目遭受攻击是由于 RewardsHypervisor 合约在对用户充值进行权限检查时存在缺陷，导致攻击者可以构造恶意合约以进行任意铸造抵押凭证。

具体分析内容如下：

1. Users can mortgage VISR tokens through the Deposit function in the RewardsHypervisor contract of Visor Finance, which will first transfer the user's VISR tokens into the contract and mints corresponding mortgage certificates to the user. If the from address passed by the user in the deposit operation is the contract address, then the owner check is performed and the delegatedTransferERC20 function of the FROM contract is called to transfer the VISR token into the mortgage contract. The owner check, however, checks whether the owner of the FROM contract is the caller. Therefore, an attacker can deploy a malicious contract so that the owner of the malicious contract satisfies this check and can then cast a mortgage certificate for any address.  

2. Attackers can directly take out the VISR mortgaged in the contract through withdraw function of RewardsHypervisor contract by using mortgage certificates forged from thin air.

因此，此次攻击是由于 RewardsHypervisor 合约在对用户充值进行权限检查时存在缺陷，导致攻击者可以构造恶意合约以进行任意铸造抵押凭证。

参考交易：

https://etherscan.io/tx/0x69272d8c84d67d1da2f6425b339192fa472898dce936f24818fda415c1c1ff3f

https://etherscan.io/tx/0x6eabef1bf310a1361041d97897c192581cd9870f6a39040cd24d7

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia