The DeFi protocol SIR.trading suffered a hack that led to the loss of all its funds amounting to $355,000. The attack was detected on March 30 by blockchain security firms.
Attack Details
The attack was described as 'clever', targeting a callback function in the vulnerable contract Vault using Ethereum's transient storage. The hacker replaced the real Uniswap pool address with one they controlled, allowing fund redirection.
Vulnerability in Ethereum's Transient Storage
SupLabsYi from Supremacy stated that the attack may indicate a vulnerability in Ethereum's transient storage, introduced with the Dencun upgrade. This feature allows temporary data storage, reducing gas fees.
Community Reaction and Developers
The stolen funds have been deposited into an address funded through Railgun. The founder of SIR.trading, known as Xatarrer, reached out to Railgun for assistance. SIR.trading's documentation warned of potential contract bugs.
The hack on SIR.trading raises concerns about security in DeFi protocols and the need for more comprehensive vulnerability testing.
