Skip to content

Commit

Permalink
📝 Add Vyper Post-Mortem
Browse files Browse the repository at this point in the history
Signed-off-by: sudo rm -rf --no-preserve-root / <[email protected]>
  • Loading branch information
pcaversaccio authored Aug 6, 2023
1 parent 7aea72b commit ad02ea9
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ A chronological and (hopefully) complete list of reentrancy attacks to date.
- [Libertify attack](https://twitter.com/peckshield/status/1678688731908411393)[^7] – 11 July 2023 | [Victim contract](https://polygonscan.com/address/0x9c80a455ecaca7025A45F5fa3b85Fd6A462a447b), [Exploit contract](https://polygonscan.com/address/0xdFcDB5A86b167B3A418F3909D6f7A2f2873F2969), [Exploit transaction](https://polygonscan.com/tx/0x7320accea0ef1d7abca8100c82223533b624c82d3e8d445954731495d4388483)
- [Conic Finance attack](https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d) – 21 July 2023 | [Victim contract](https://etherscan.io/address/0xBb787d6243a8D450659E09ea6fD82F1C859691e9), [Exploit contract](https://etherscan.io/address/0x743599BA5CfA3cE8c59691aF5ef279AaaFA2E4EB), [Exploit transaction](https://etherscan.io/tx/0x8b74995d1d61d3d7547575649136b8765acb22882960f0636941c44ec7bbe146)
- [EraLend attack](https://twitter.com/BeosinAlert/status/1683880646811299853) – 25 July 2023 | [Victim contract](https://explorer.zksync.io/address/0x00A1C271df375660f47293fd84B53572fded0107), [Exploit contract](https://explorer.zksync.io/address/0x7d8772DCe73cDA0332bc47451aB868Ac98F335F0), [Exploit transaction](https://explorer.zksync.io/tx/0x99efebacb3edaa3ac34f7ef462fd8eed85b46be281bd1329abfb215a494ab0ef)
- [Curve attack](https://hackmd.io/@LlamaRisk/BJzSKHNjn) – 30 July 2023 | [Victim contract](https://etherscan.io/address/0xC4C319E2D4d66CcA4464C0c2B32c9Bd23ebe784e), [Exploit contract](https://etherscan.io/address/0x30FB95794a2051ABe30A67892B3A1FA73947aEE5), [Exploit transaction](https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801)
- [Curve attack](https://hackmd.io/@LlamaRisk/BJzSKHNjn)[^8] – 30 July 2023 | [Victim contract](https://etherscan.io/address/0xC4C319E2D4d66CcA4464C0c2B32c9Bd23ebe784e), [Exploit contract](https://etherscan.io/address/0x30FB95794a2051ABe30A67892B3A1FA73947aEE5), [Exploit transaction](https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801)

> Some of the exploits carried out involve multiple separate transactions as well as multiple victim and exploit contracts. For each attack, I have listed the most affected victim contract, the most critical exploit contract, and the most devastating exploit transaction.
Expand All @@ -86,3 +86,4 @@ A chronological and (hopefully) complete list of reentrancy attacks to date.
[^5]: The same exploit hit two other victims with almost the same amount of loss: [Victim contract 2](https://arbiscan.io/address/0x367351F854506DA9B230CbB5E47332b8E58A1863), [Victim contract 3](https://arbiscan.io/address/0xD3e323a672F6568390f29f083259debB44C41f41).
[^6]: We list the victim contract, the exploit contract, and the exploit transaction on Optimism. However, the same exploit was carried out on Ethereum, albeit with a smaller loss amount: [Victim contract](https://etherscan.io/address/0x9aa024D3fd962701ED17F76c17CaB22d3dc9D92d), [Exploit contract](https://etherscan.io/address/0x56A35FAe9b0416360e1752A9abE78D89F51517CF), [Exploit transaction](https://etherscan.io/tx/0xefc4ac015069fdf9946997be0459db44c0491221159220be782454c32ec2d651).
[^7]: We list the victim contract, the exploit contract, and the exploit transaction on Polygon. However, the same exploit was carried out on Ethereum, albeit with a smaller loss amount: [Victim contract](https://etherscan.io/address/0x429032A407aed3D5fF84caf38EFF217eB4d322A9), [Exploit contract](https://etherscan.io/address/0xdFcDB5A86b167B3A418F3909D6f7A2f2873F2969), [Exploit transaction](https://etherscan.io/tx/0xcb0ad9da33ecabf75df0a24aabf8a4517e4a7c5b1b2f11fee3b6a1ad9299a282).
[^8]: The technical post-mortem on the reentrancy lock vulnerability from Vyper can be found [here](https://hackmd.io/@vyperlang/HJUgNMhs2).

0 comments on commit ad02ea9

Please sign in to comment.