DeFi

Amber Group: Vulnerability In Mai Finance’s Vault Has Been Fixed

Key Points:

  • On October 18, 2022, two vaults belonging to Mai Finance (SCSEMVT and YCSEMVT) contained a significant vulnerability, according to a statement from Amber Group’s blockchain security team.
  • Due to this flaw, an attacker might manipulate the price of the collateral, take out the whole amount from the pool, and escape with bad debts.
  • On October 19, Amber Group approached the QiDao team. On October 20, the QiDao team launched a fresh Oracle contract after confirming the problem and developing a solution.
On October 18, 2022, two of Mai Finance’s vaults (SCSEMVT and YCSEMVT) included a significant vulnerability that was found by Amber Group’s blockchain security team. Due to this flaw, an attacker might manipulate the price of the collateral, take out the whole amount from the pool, and escape with bad debts.

Users may borrow stablecoin (MAI) at 0% interest through Mai Finance, a zero-interest lending system. Anyone may establish QiDao vaults and put down assets to be used as security for loans.

With the overcollateralized stablecoin system known as Mai, loans are always secured by having more value locked than the debt.

ChainSecurity revealed a new type of reentrancy flaw in Curve in the middle of October 2022. The so-called read-only reentrancy vulnerability enables an attacker to revisit the get virtual price() oracle function through a carefully written smart contract and obtain an inflated LP token price in return, opening the door for criminals to benefit.

Amber Group: Vulnerability In Mai Finance’s Vault Has Been Fixed 4

To get the price of an LP token produced from the pegged assets of a stable swap pool, a lending protocol linked with Curve LPs often employs the oracle function offered by Curve and named get virtual price().

For the time being, the attacker is free to alter the execution flow any way they choose. What happens if the attacker calls get virtual price() once more in the fallback function’s initial line? The virtual price increases when the quantity of Curve LP tokens is reduced, and the balances are not updated. Then, another batch of underlying assets might be removed, or even some pools could be drained using the manipulated pricing.

The QiDao’s YCSEMVT vault modified get virtual price() as one of the sources to estimate the collateral price as a result of becoming one of the targets of the new read-only reentrancy attack.

On October 19, Amber Group approached the QiDao team. On October 20, the QiDao team launched a fresh Oracle contract after confirming the problem and developing a remedy.

On October 24, the same vulnerability was exploited on Polygon, but it was not related to QiDao.

DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

Join us to keep track of news: https://linktr.ee/coincu

Website: coincu.com

Harold

Coincu News

Harold

With a passion for untangling the complexities of the financial world, I've spent over four years in financial journalism, covering everything from traditional equities to the cutting edge of venture capital. "The financial markets are a fascinating puzzle," I often say, "and I love helping people make sense of them." That's what drives me to bring clear and insightful financial journalism to the readers of Coincu.

Recent Posts

Best Altcoins to Buy Today: Qubetics Rides 1000x Potential to Hit $2.6M, Ethereum Stays Rangebound, Tron USDT Transactions Hit $52B

Discover the best cryptos to buy and hold today: Qubetics leads with 1000x potential, Ethereum…

39 minutes ago

Trump Media Company Is Pushing New Venture For Crypto Service

With the platform facing a cracked whip, Trump Media company is expanding into new business…

1 hour ago

Crypto Advisory Council Now A White House Position Attracting Leaders

Major crypto firms, including Ripple, Kraken, and Circle, are competing for spots on President-elect Donald…

2 hours ago

Analyst Sounds Major Breakout Alert Amid Shiba Inu, WallitIQ, And Dogecoin Price Recoveries

Analysts highlight a breakout alert as Shiba Inu (SHIB), and Dogecoin show signs of recovery…

2 hours ago

SEC Chair Gary Gensler Will Lose Power From January 20

SEC Chair Gary Gensler will step down on January 20, 2025, coinciding with President-elect Donald…

2 hours ago

MicroStrategy Convertible Notes Now Out of Stock With $3B Raised

The MicroStrategy convertible notes offering, initially set at $1.75 billion, was increased to $2.6 billion…

3 hours ago

This website uses cookies.