基於 Blast L2 的借貸平台 MonoSwap 犯了代價高昂的錯誤，導致用戶損失 2,600 萬美元

MonoSwap 將自己描述為“Blast 原生流動性空間”，透過其 X 帳戶宣布遭到駭客攻擊。宣布此次駭客攻擊的貼文詳細介紹了 MonoSwap 開發人員如何「安裝網路釣魚應用程序，以加入與冒充風險投資人的詐騙者的通話。攻擊者將殭屍網路安裝到他的辦公室電腦中，該電腦可以存取所有與 MonoSwap 相關的錢包和合約。

A Layer 2 lending protocol on the Blast blockchain liquidated users to the tune of $26 million after a developer fell victim to a phishing scam.

在一名開發人員成為網路釣魚詐騙的受害者後，Blast 區塊鏈上的第 2 層借貸協議清算了用戶高達 2,600 萬美元的資金。

MonoSwap, which describes itself as a “Blast native liquidity space,” announced the hack on its X account Friday.

MonoSwap 將自己描述為“Blast 原生流動性空間”，週五宣布其 X 帳戶遭到駭客攻擊。

The post announcing the hack details how a developer for MonoSwap “installed a phishing app to join a venture capital call with scammers who posed as members of a VC.”

宣布此次駭客攻擊的貼文詳細介紹了 MonoSwap 的開發人員如何「安裝網路釣魚應用程序，以加入與冒充風投成員的詐騙者進行的風險投資電話會議」。

It also notes that “the attackers installed the botnet into his office PC, which has access to all MonoSwap-related wallets and contracts.”

它還指出，“攻擊者將殭屍網路安裝到他的辦公室電腦中，該電腦可以訪問所有與 MonoSwap 相關的錢包和合約。”

The hackers then withdrew most of the staked liquidity positions, causing damage to the protocol, according to the post. The original post included a link to the hacker’s website, but this was later removed after Protos reached out to ask, “Do you think it was prudent to provide a link to the hacker’s website in your announcement post?”

該貼文稱，駭客隨後撤回了大部分質押的流動性頭寸，對協議造成了損害。最初的帖子包含一個指向黑客網站的鏈接，但在 Protos 詢問“您認為在公告帖子中提供指向黑客網站的鏈接是否謹慎？”後，該鏈接被刪除了。

MonoSwap’s documentation has a page labeled “Security Measures” which claims “MonoSwap’s expertly crafted smart contracts are developed by seasoned professionals with a deep understanding of the DeFi industry. We prioritize the safety and optimization of your investments by incorporating a robust set of features and security measures.”

MonoSwap 的文檔中有一個標有「安全措施」的頁面，其中聲稱「MonoSwap 精心設計的智能合約是由對 DeFi 行業有深入了解的經驗豐富的專業人士開發的。我們透過整合一套強大的功能和安全措施來優先考慮您投資的安全和優化。

There is also a page labeled “Audits” which optimistically claims “Coming soon,” though the page also says “Last updated 6 months ago.”

還有一個標有“審核”的頁面，樂觀地聲稱“即將推出”，儘管該頁面還顯示“上次更新是在 6 個月前”。

The protocol has additional immaturities, including describing its wrapped token, xMONO, as a governance token, despite the fact that, as far as Protos has been able to determine, there is no voting mechanism to currently use those governance tokens for governance.

該協議還有其他不成熟之處，包括將其包裝代幣 xMONO 描述為治理代幣，儘管據 Protos 所知，目前沒有投票機制可以使用這些治理代幣進行治理。

Protos has reached out to MonoSwap for clarification on the status of the protocol audits, why one executive had access to all of these mission critical resources on their computer, and what the use of the governance token is. At press we have not received a response.

Protos 已聯繫 MonoSwap，以澄清協議審計的狀態、為何一名高階主管可以存取其電腦上的所有這些關鍵任務資源，以及治理代幣的用途。截至發稿，我們尚未收到回覆。

Data from DefiLlama shows the ‘Total Value Locked’ for this protocol dropped from approximately $1.5 million to $200,000 today.

DefiLlama 的數據顯示，該協議的「鎖定總價值」從約 150 萬美元降至如今的 20 萬美元。