DeFi exploits attributed to unaudited projects, data shows as Bungee exchange confirms operations
Recent research by on-chain aggregator IntoTheBlock shows that the majority of exploits in the decentralized finance (DeFi) space are the result of unaudited projects. With this, the study concludes that while an audit may not guarantee safety, it should certainly be a minimum requirement for DeFi protocols.
The vast majority of DeFi exploits relate to unaudited projects. So while an audit may not guarantee safety, it should certainly be a minimum requirement for DeFi protocols.
— IntoTheBlock (@intotheblock) January 17, 2024
https://t.co/PnlLwP6D07 pic.twitter.com/shbB91FioN
Bungee Exchange, powered by the recently exploited SocketDotTech protocol, has assured users that it is safe to use with all operations restored.
Bungee is FULLY OPERATIONAL & SAFE TO USE.
— Bungee (@BungeeExchange) January 17, 2024
Earlier, the exchange had indicated that since it does not request infinite approvals by default, Bungee users should be largely unaffected. Nevertheless, it paused the affected contracts while resuming bridging on the network.
It comes barely 24 hours after SocketDotTech protocol was exploited, with at least $3.3 million believed to be stolen.
❗️@SocketDotTech / @BungeeExchange is currently under ongoing attack. The loss is about $3.3M!
— Hacken (@hackenclub) January 16, 2024
Check more details below... pic.twitter.com/8z0DibsJmR
Reportedly, 231 wallets were impacted with an average loss of $14,000 each.
SocketDotTech has issued an official statement following the exploit, indicating that the attack affected wallets with infinite approvals to Socket contracts.
In response, all affected contracts have been paused with the protocol committing to keep users informed.
Urgent
— Socket (@SocketDotTech) January 16, 2024
Socket has experienced a security incident which affected wallets with infinite approvals to Socket contracts.
We have identified the issue & have paused the affected contracts.
We’re working on the situation & will keep you informed with regular updates & next steps.
Among the stolen assets include Ethereum (ETH), Polygon (MATIC), Wrapped Bitcoin (WBTC), Wrapped Ether (WETH), and Dai (DAI).
Among the stolen assets pic.twitter.com/Uf52BBfjrr
— Hacken (@hackenclub) January 16, 2024
Blockchain security and data analytics firm PeckShield reported the incident first, calling SocketDotTech's attention to the incident.
Hi @SocketDotTech, you may want to take a look: https://t.co/EQGnWELlie
— PeckShield Inc. (@peckshield) January 16, 2024
According to PeckShield, the bad route exploited in the hack was added 3 days ago and is now disabled. The security firm attributes the attack to "...incomplete validation of user input, which is exploited to steal funds from users who have approved the vulnerable SocketGateway contractocketGateway contract."
The bad actor exploited the mainnet, with users being asked to revoke all addresses as a precaution.
This address has been highlighted as being involved in the attack, with users asked to revoke it as it shows up as Socket: Gateway on Etherscan.
SocketDotTech is an interoperability protocol bringing seamless connectivity across blockchains, while Bungee is a bridge aggregator powered by Socket and enables users to find the best route for bridging.
Bungee finds multiple bridging routes via supported decentralized exchanges (DEXes) and bridges, considering any swaps that may be needed before/after bridging.
Neither SocketDotTech nor Bungee Exchange immediately responded to FXStreet's request for comment.
Author
Lockridge Okoth
FXStreet
Lockridge is a believer in the transformative power of crypto and the blockchain industry.
