The DeFi protocol SIR.trading, also known as Synthetics Implemented Right, was exploited, leading to a loss of $355,000 due to a flaw in its Vault contract.
Details of the Attack
The attack was first reported by TenArmor, who observed suspicious transactions and noted that the funds were transferred to the privacy platform RailGun.
Exploiting the Vulnerability
According to Decurity, the hackers exploited a flaw in the 'uniswapV3SwapCallback' function of the Vault contract, which allowed for address spoofing. This function relied on transient storage, enabling manipulation.
Consequences and Risks
The anonymous creator of SIR.trading, Xatarrer, acknowledged the attack, stating it was the worst news a protocol could receive. This raises questions about the security of utilizing transient storage in Ethereum.
The attack on SIR.trading raises significant concerns about the security of using transient storage. Experts stress the importance of reinforcing security measures in smart contracts to prevent similar incidents in the future.
