基于 Blast L2 的借贷平台 MonoSwap 犯了代价高昂的错误，导致用户损失 2600 万美元

MonoSwap 将自己描述为“Blast 原生流动性空间”，通过其 X 账户宣布遭到黑客攻击。宣布此次黑客攻击的帖子详细介绍了 MonoSwap 开发人员如何“安装网络钓鱼应用程序，以加入与冒充风险投资人的诈骗者的通话。攻击者将僵尸网络安装到他的办公室电脑中，该电脑可以访问所有与 MonoSwap 相关的钱包和合约。”

A Layer 2 lending protocol on the Blast blockchain liquidated users to the tune of $26 million after a developer fell victim to a phishing scam.

在一名开发商成为网络钓鱼诈骗的受害者后，Blast 区块链上的第 2 层借贷协议清算了用户高达 2600 万美元的资金。

MonoSwap, which describes itself as a “Blast native liquidity space,” announced the hack on its X account Friday.

MonoSwap 将自己描述为“Blast 原生流动性空间”，周五宣布其 X 账户遭到黑客攻击。

The post announcing the hack details how a developer for MonoSwap “installed a phishing app to join a venture capital call with scammers who posed as members of a VC.”

宣布此次黑客攻击的帖子详细介绍了 MonoSwap 的开发人员如何“安装网络钓鱼应用程序，以加入与冒充风投成员的诈骗者进行的风险投资电话会议”。

It also notes that “the attackers installed the botnet into his office PC, which has access to all MonoSwap-related wallets and contracts.”

它还指出，“攻击者将僵尸网络安装到他的办公室电脑中，该电脑可以访问所有与 MonoSwap 相关的钱包和合约。”

The hackers then withdrew most of the staked liquidity positions, causing damage to the protocol, according to the post. The original post included a link to the hacker’s website, but this was later removed after Protos reached out to ask, “Do you think it was prudent to provide a link to the hacker’s website in your announcement post?”

该帖子称，黑客随后撤回了大部分质押的流动性头寸，对协议造成了损害。最初的帖子包含一个指向黑客网站的链接，但在 Protos 询问“您认为在公告帖子中提供指向黑客网站的链接是否谨慎？”后，该链接被删除了。

MonoSwap’s documentation has a page labeled “Security Measures” which claims “MonoSwap’s expertly crafted smart contracts are developed by seasoned professionals with a deep understanding of the DeFi industry. We prioritize the safety and optimization of your investments by incorporating a robust set of features and security measures.”

MonoSwap 的文档中有一个标有“安全措施”的页面，其中声称“MonoSwap 精心设计的智能合约是由对 DeFi 行业有深入了解的经验丰富的专业人士开发的。我们通过整合一套强大的功能和安全措施来优先考虑您投资的安全和优化。”

There is also a page labeled “Audits” which optimistically claims “Coming soon,” though the page also says “Last updated 6 months ago.”

还有一个标有“审核”的页面，乐观地声称“即将推出”，尽管该页面还显示“上次更新是在 6 个月前”。

The protocol has additional immaturities, including describing its wrapped token, xMONO, as a governance token, despite the fact that, as far as Protos has been able to determine, there is no voting mechanism to currently use those governance tokens for governance.

该协议还有其他不成熟之处，包括将其包装代币 xMONO 描述为治理代币，尽管据 Protos 所知，目前没有投票机制可以使用这些治理代币进行治理。

Protos has reached out to MonoSwap for clarification on the status of the protocol audits, why one executive had access to all of these mission critical resources on their computer, and what the use of the governance token is. At press we have not received a response.

Protos 已联系 MonoSwap，以澄清协议审计的状态、为何一名高管可以访问其计算机上的所有这些关键任务资源，以及治理代币的用途。截至发稿，我们尚未收到回复。

Data from DefiLlama shows the ‘Total Value Locked’ for this protocol dropped from approximately $1.5 million to $200,000 today.

DefiLlama 的数据显示，该协议的“锁定总价值”从约 150 万美元降至如今的 20 万美元。