Hackers hacked DeFi projects Agave and Hundred Finance – Bits Media

Another hack has occurred in the field of decentralized finance. This time, the Agave and Hundred Finance projects suffered - the attackers managed to withdraw assets totaling $11 million.

Hackers managed to exploit a vulnerability in the smart contract function to support "wrapped ETH" (weth) v seti Gnosis Chain. Attackers could continue to borrow cryptocurrencies before, How apps were able to count debt and collateral and stop issuing debt cryptocurrencies. Therefore, hackers repeatedly used the same funds as collateral to obtain credit tokens and, in the end, emptied project liquidity pools.

Currently known, what the attackers were able to deduce $11 million in wETH tokens, wBTC, LINK, USDC, wXDAI и Gnosis. At the same time, it is almost impossible to return funds, especially, that hackers used the Tornado Cash mixer to launder cryptocurrencies.

The developer of smart contracts under the pseudonym Shegen emphasized, that the Agave and Hundred Finance protocols use the same code, same as the popular DeFi protocol Aave, in which assets are blocked on $18.4 billion. More likely, Aave developers have repeatedly audited and fixed the vulnerability, however, the case itself is very indicative:

“Even if the code looks extremely safe, and there may be a vulnerability in it, that will crush your hopes. Looks like, You can’t trust even the most secure code.”.

Shegen later conducted further research and noted, that vulnerability was the reason, that Agave developers used the feature in an "unsafe" way. but, the likelihood of hacking was not too high. Large projects like Curve and Aave conduct additional collateral checks when issuing loans and such a situation is impossible there.

Recall, that the decentralized platform Deus Finance was recently hacked. The attackers stole 200 000 DAO и 1 101.8 ETH, as well as other assets worth approx. $3 million.