TronWeekly

Crypto World News

You are here: Home / Archives for exploit

exploit

Solana’s Magic Eden To Refund Users After “Massive Exploit”

by

Using suspicious photos in place of users’ NFTs, Solana’s top cross-chain NFT platform Magic Eden revealed on Twitter that one of the third-party picture service providers had been hijacked.

The announcement was made yesterday, in response to complaints from community members who said that during the course of the previous day, instead of the NFTs they attempted to see, they were seeing screenshots and stills from the television show “The Big Bang Theory” and risqué content.

The Solana NFT giant reportedly made an attempt to resolve the problem within an hour. Even still, some of the graphic pictures persisted.

The Magic Eden team, in a statement, encouraged consumers to refresh their web browsers in a message reassuring them that their NFTs were unaffected.

The statement read,

“Your NFTs are safe and Magic Eden has not been hacked. Make sure you do a hard refresh on your browser to fix it”.

The NFT marketplace believes that other websites were also impacted by the third-party vendor attack, but Magic Eden does not feel that it was specifically targeted by it. It would not disclose the name of the third-party provider out of security concerns.

25 Fake NFTs Sold On Solana’s Magic Eden

Marketplace for nonfungible tokens (NFTs) Magic Eden has promised to reimburse all users who were tricked into buying fraudulent NFTs on their website as a result of a bug.

The platform said in a statement on January 4 that a flaw in the “activity indexer,” which had just been made available for its Snappy Marketplace and Pro Trade tools, effectively allowed fraudulent NFTs to avoid verification and be displayed among real NFT collections.

Magic Eden said that the exploit resulted in 25 counterfeit NFTs being sold over four collections in the last day, but it is still unclear whether any NFTs were impacted after that.

The costly and well-liked collections ABC and y00ts, both headquartered in Solana, were two of the projects that were impacted.

By temporarily blocking these tools and removing the “entry points” that permitted unconfirmed NFTs to pass through, the NFT platform claimed that the problem has been fixed.

Additionally, it cautioned users against buying unverified NFTs and instructed them to “hard refresh” their browsers to make sure the unverified listings are gone.

GMX DEX loses $565K in a recent exploit

by

GMX, a decentralized exchange, fell victim to a recent exploit. According to reports, a price manipulation attack on the decentralized exchange (DEX) GMX allowed an exploiter to steal $565,000 from the Avalanche (AVAX)/USD market.

The attack, which affected GLP token holders who contributed liquidity to GMX in the form of AVAX (the Avalanche token), is believed to have been carried out by an anonymous exploiter who profited from GMX’s “minimum spread” and “zero price effect” characteristics.

GMX confirmed the exploit on Sunday

In a Sunday post on Twitter, the DEX acknowledged the price manipulation exploit but said that despite setting a $2 million cap on long holdings and a $1 million cap on short positions, the AVAX/USD market will continue to be active.

https://twitter.com/GMX_IO/status/1571439325413511169

Joshua Lim, the head of derivatives at Genesis Trading, was one of the first to examine the exploit. He claimed that the perpetrator “successfully extracted profits from the DEX’s AVAX/USD market by starting large positions at 0 slippages” before transporting the AVAX/USD to centralized exchanges at a marginally higher price.

The first cycle of this exploit method, according to Lim, began at 1:15 AM UTC on Sunday and was repeated five times. Approximately $4 to $5 million worth of AVAX were moved during each cycle, and the exploiter profited by about $565,000 after paying spreads to market participants on other exchanges.

While GMX quickly limited short and long open interest for AVAX/USD to safeguard the DEX from further manipulation, Lim stated that GMX may have to do away with its “zero price effect” feature despite having signed up a lot of users thus far.

A trader with the correct approach might wipe out GLP token holders, according to Taureau, the founder of layer-2 DEX ZigZag, who expressed worry about the long-term viability of GMX’s exchange platform in a video chat on September 2.

In other events, a hacker was able to steal 200 WETH from the Ethereum PoW chain thanks to a replay attack on Omni bridge. Security company BlockSec discovered a replay attack on the Ethereum PoW chain on September 18.

Through the Omni bridge, the attacker sent 200 WETH from the Ethereum PoS chain. According to reports, the transaction was duplicated on the Ethereum PoW chain.