Timeline | Vyper compiler malfunction, Curve protocol and others attacked.

On July 31st, the official Twitter account of Ethereum EVM compiler Vyper announced a tweet stating that versions 0.2.15, 0.2.16, and 0.3.0 of Vyper are susceptible to recursive locking issues. Investigations are ongoing, but any projects that rely on these versions should immediately contact the team. Subsequently, many related protocols have issued tweets announcing attacks caused by the related issues, with Curve Finance being particularly severely affected. The following is a real-time timeline update of the related events:

07-30 21:43

Curve ecosystem liquidity platform Conic Finance completes $1 million financing

BlockBeats News, on July 30th, Conic Finance announced that it has received $1 million in funding from Curve founder Michael Egorov. This round of funding will be used to support Conic's development work. Conic Finance stated that the core team of Conic has been working closely with Curve core contributors to better support the Curve ecosystem and further develop themselves before the event last week. The valuation of this round of financing is $17 million, and the tokens sold will be linearly unlocked within the next 8 months. Conic will announce more details about the V2 version in the coming weeks.

07-30 23:36

JPEG'd: pETH-ETH curve pool was attacked, other assets are safe

BlockBeats News, on July 30th, JPEG'd officially stated that the pETH-ETH curve pool was attacked, and other NFT and treasury assets were compromised.

07-31 08:09

Curve Finance: Some stablecoin pools were attacked due to Vyper recursive lock failure

BlockBeats News, on July 31st, Curve Finance announced on social media that due to a recursive lock failure, many stablecoin pools (alETH/msETH/pETH) using Vyper 0.2.15 were attacked. The team is evaluating the situation and will update the community as the situation develops. The crvUSD contract and other funds are not affected. Earlier, the Ethereum programming language Vyper announced that the recursive lock of versions 0.2.15, 0.2.16, and 0.3.0 has failed and is currently under investigation.

07-31 08:11

派盾：Curve Finance attack has caused a loss of 52 million US dollars

BlockBeats News, on July 31st, according to PeckShield monitoring, as of now, the Curve Finance stablecoin pool attack has caused a total loss of $52 million for Alchemix, JPEG'd, MetronomeDAO, deBridge, Ellipsis, and CRV/ETH pool.

07-31 08:17

Due to the impact of the attack, Curve Finance TVL decreased by more than 24%

BlockBeats News, on July 31st, according to DefiLlama data, due to the impact of the attack incident, Curve Finance TVL has decreased from 3.266 billion US dollars on July 30th to the current 2.481 billion US dollars, a decrease of 785 million US dollars, with a 24-hour decline of 24.03%.

07-31 08:21

CRV is now reporting at $0.6264, with a drop of over 11% in the past 24 hours.

BlockBeats News, on July 31st, according to OKX market information, affected by the attack incident, CRV briefly fell below 0.6 US dollars in the early morning today and then slightly rebounded. It is now reported at 0.6264 US dollars, with a 24-hour decline of 11.74%.

07-31 08:25

Alchemix: alETH/ETH Curve pool attacked, losing about 5000 ETH, Alchemix treasury funds are safe

BlockBeats News, on July 31st, DeFi lending protocol Alchemix announced on social media that on July 30th, Curve Finance notified Alchemix that its alETH/ETH pool may be vulnerable to an exploit due to a bug in Vyper. Alchemix quickly took action and removed AMO-controlled liquidity from the Curve pool through an AMO contract. During the process of removing the remaining liquidity, the alETH/ETH Curve pool was attacked by an attacker. Currently, the alETH reserve has lost approximately 5000 ETH.

07-31 08:31

Metronome: The msETH-ETH pool on Curve has been attacked and mainnet functionality has been temporarily suspended.

BlockBeats News, on July 31st, DeFi synthetic asset protocol Metronome announced on social media that as a precautionary measure, the mainnet functionality of Metronome has been temporarily suspended to minimize damage due to an attack on the msETH-ETH pool on Curve. Metronome stated that a vulnerability involving multiple Curve pools had been exploited, and the msETH-ETH pool was attacked, with the attacker stealing liquidity from the pool. Liquidity providers for any msUSD trading pairs and Optimism users using msETH on Velodrome should be aware that their positions are not affected. In addition, all deposits and open positions in Metronome are not affected by this incident.

07-31 08:35

派盾：某白帽黑客向 Curve 部署地址归还 2879 枚 ETH Translation:

07-31 08:35

Paiduin: A white hat hacker returned 2879 ETH to Curve deployment address

BlockBeats News, on July 31st, according to PeckShield monitoring, c0ffeebabe.eth returned 2,879 ETH (worth about $5.4 million) to the Curve deployment address.

07-31 08:38

Ellipsis Finance: Evaluating the situation of a few BNB stable pools that were attacked, which were compiled using an old version of the Vyper compiler

BlockBeats News, on July 31st, Ellipsis Finance, a BNB Chain ecosystem DEX that uses the Curve mechanism, announced that a small number of BNB stable pools compiled with the old version of Vyper compiler were attacked and the situation is currently being evaluated.

BlockBeats News, on July 31st, according to information on the Curve Finance page, pETH and alETH have experienced varying degrees of negative premiums due to the attack. The exchange ratio of alETH/ETH is 1:0.7742, and the exchange ratio of pETH/ETH is 1:0.4513. Note from BlockBeats: pETH is an ETH derivative asset issued by the JPEG'd Protocol. alETH is a synthetic asset anchored to the price of ETH in the Alchemix protocol.

07-31 09:04

Due to the decline in CRV price, the founder of Curve's on-chain CRV collateralized borrowing and lending health rate has decreased.

BlockBeats News, on July 31st, affected by the attack incident, the price of CRV fell, and the on-chain CRV mortgage loan health rate of Curve founder decreased. As of the time of publication, its loan health rate on the Aave protocol is 1.72, on Fraxlend is 1.61, and on Abracadabra is 1.67. According to previous news from BlockBeats, as of June 15th, the Curve founder had deposited a total of 431 million CRV (approximately 246 million US dollars) into multiple decentralized lending platforms and borrowed 101.5 million US dollars in stablecoins, including: depositing 288.4 million Curve (approximately 166 million US dollars) to borrow 63.44 million USDT on Aave; depositing 79.4 million Curve (approximately 45.65 million US dollars) to borrow 20.5 million MIM on Abracadabra; depositing 46.65 million Curve (approximately 26.82 million US dollars) to borrow 12.86 million FRAX on Fraxlend; depositing 16 million Curve (approximately 9.27 million US dollars) to borrow 4.68 million DOLA on Inverse.

07-31 09:09

Upbit: CRV deposit and withdrawal services have been temporarily suspended

BlockBeats News, on July 31st, Upbit, a South Korean cryptocurrency exchange, announced that due to the attack on a portion of the Curve stablecoin pool, the volatility of CRV has increased significantly. As a result, Upbit has temporarily suspended Curve (CRV) deposit and withdrawal services.

07-31 09:12

SlowMist Chief Information Security Officer: Vyper official documentation has obvious omissions

BlockBeats News, on July 31st, 23pds, the Chief Information Security Officer of SlowMist, stated on their social media platform that the version recommended by the installation interface of Vyper's official documentation is incorrect. Earlier, Ethereum programming language Vyper announced that the recursive lock of versions 0.2.15, 0.2.16, and 0.3.0 has failed and is currently under investigation.

07-31 09:27

Curve founder transferred 16 million CRV to Aave 5 hours ago

BlockBeats News, on July 31st, on-chain information shows that the founder of Curve transferred 16 million CRV (worth approximately $9.93 million) to Aave 5 hours ago. This move may be aimed at improving its loan-to-value ratio.

07-31 09:41

CRV on-chain transaction prices experienced violent fluctuations this morning, with instantaneous prices approaching zero.

BlockBeats News, on July 31st, according to dexscreener information, there was a sharp fluctuation in the trading price of CRV on multiple DEXs this morning, and the instantaneous price was close to zero. Taking Uniswap as an example, during the period from 3:05 to 3:15 this morning, there was a large sell-off of CRV, and its instantaneous price may have approached zero due to liquidity reasons, and then quickly rebounded.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia