Table of Contents:

· Sandwich Attack Occurs on Blast

· Community Still Concerned About Blast's Security Issues

Blast experienced a sandwich attack

On the early morning of December 1st, a trader claimed on social media that the slippage limit for USDT deposits in Blast was set to 10% by default. After a user initiated a transaction, the transaction was sandwiched by a DAI transaction worth $70 million in Curve 3pool. Within an hour, the attacker had stolen over $100,000.

Later, Blast announced a compensation plan for the sandwich attack on its social media platform. Blast stated that when users deposit USDT, Blast Bridge will convert it to DAI in the deposit transaction. However, a configuration error in the UI slider parameter caused one user to receive 100,000 fewer DAI than they should have in two transactions. Blast stated that the configuration error has been resolved and will send the affected user the amount lost due to slippage and an additional 10% bonus, totaling 110,000 USDT.

Blast supplement, after checking the transaction history, it was confirmed that only one user's transaction was affected.

Community still concerned about Blast's security issues

It took only about ten minutes from the trader's warning of a possible attack to Blast providing a solution. However, the community is still concerned about Blast's security issues and believes that it is not a true L2 solution for Ethereum. Some community members even suggest that Blast should stop calling itself a bridge.

There are also users in the comments section of Blast's official tweet who claim they cannot understand how "miscalculated slippage parameters" led to 200,000 USDT being exchanged for 100,000 DAI. Even if the slippage was set to 50% for some crazy reason, they do not understand how MEV allowed this transaction to occur.

Due to the fact that the official original transaction amount has not been disclosed, we have no way of guessing whether Blast's processing method is reasonable or not. However, the concerns of community users also reflect that Blast has not yet gained complete market trust.

Since November 21st, when Blur founder Pacman announced the new project Blast, as of December 1st, Blast's TVL has reached 640 million US dollars in just ten days.

However, the rapidly rising TVL data has sparked a big discussion in the market about its security risks. Polygon engineers have even stated that "this is not L2" and have referred to Blast as simply an intelligent contract with two functions: 1) accepting user funds and 2) investing user funds into protocols such as Lido. There is no test network, no trading, no bridge, no Rollup, and no transaction data sent to Ethereum.

Later, Blast issued a statement in response to security concerns, stating that one of the multi-signature addresses will be updated within a week and that the contract settings were made with security in mind.

The viewpoint held by Blast is "As long as the project itself does not engage in wrongdoing and there is no time lock, upgrading smart contracts is a safer choice." But will users choose to trust Blast?

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia