Convergence 协议确认其于 8 月 1 日通过智能合约漏洞遭到黑客攻击，一名黑客铸造并出售了价值 2.1 亿美元的原生代币

7 月份，加密货币生态系统因黑客攻击损失了约 2.66 亿美元，其中大部分来自印度交易平台 WazirX 的 2.3 亿美元黑客攻击

Decentralized finance (DeFi) protocol Convergence has confirmed that it was exploited via a smart contract vulnerability on Aug. 1, allowing a hacker to mint and sell $210,000,000 in its native token, as well as pilfer $2,000 in unclaimed staking rewards.

去中心化金融 (DeFi) 协议 Convergence 已确认，该协议于 8 月 1 日被智能合约漏洞利用，导致黑客铸造并出售 2.1 亿美元的原生代币，并窃取 2,000 美元无人认领的质押奖励。

According to a new post-mortem from Wireshark, the pseudonymous founder of the Convergence protocol, the attacker exploited the protocol’s CvxRewardDistributor contract, enabling them to mint and sell 58,000,000 CVG tokens for roughly $210,000.

根据 Convergence 协议的匿名创始人 Wireshark 的最新尸检报告，攻击者利用了该协议的 CvxRewardDistributor 合约，使他们能够铸造并以大约 21 万美元的价格出售 58,000,000 个 CVG 代币。

The attacker also stole about $2,000 in unclaimed rewards from Convex, a DeFi protocol designed to maximize rewards for Curve liquidity providers.

攻击者还从 Convex 窃取了约 2,000 美元无人认领的奖励，Convex 是一种 DeFi 协议，旨在最大限度地提高 Curve 流动性提供者的奖励。

According to Etherscan, the attack occurred on Aug. 1 at around 3:00 am UTC.

据 Etherscan 称，这次攻击发生在 UTC 时间 8 月 1 日凌晨 3:00 左右。

Blockchain security firm PeckShield noted that after minting the CVG tokens, the attacker quickly swapped it into 60 wrapped-Ether and 15,900 Curve.fi FRAX.

区块链安全公司 PeckShield 指出，在铸造 CVG 代币后，攻击者迅速将其兑换成 60 个包装以太币和 15,900 个 Curve.fi FRAX。

The movements have since led to a near-100% price wipeout of the CVG governance token, which is now trading at $0.0004 with a market cap of just $57,000, according to CoinMarketCap data.

根据 CoinMarketCap 数据，此后的走势导致 CVG 治理代币价格近 100% 下跌，目前该代币的交易价格为 0.0004 美元，市值仅为 57,000 美元。

Convergence said the attack was enabled by the team accidentally deleting a crucial line of code in its smart contract that distributes CVG staking rewards. They made the change after the smart contract code was audited four times.

Convergence 表示，此次攻击是由于该团队意外删除了其智能合约中分配 CVG 质押奖励的关键代码行而导致的。他们在智能合约代码经过四次审核后做出了更改。

“The modification (gas-optimization on the first hand) led us to remove the line of code that was checking the input given to the function,” it explained.

“修改（首先是气体优化）导致我们删除了检查函数输入的代码行，”它解释道。

The attacker used this to exploit the CvxRewardDistributor contract through the claimMultipleStaking function.

攻击者利用该漏洞通过 ClaimMultipleStake 函数来利用 CvxRewardDistributor 合约。

This meant the staking contract couldn’t be validated, allowing the attacker to pass a separate malicious contract with the same signature as the claimCvgCvxMultiple function.

这意味着质押合约无法得到验证，从而允许攻击者传递与 ClaimCvgCvxMultiple 函数具有相同签名的单独恶意合约。

The attacker then minted all tokens dedicated to staking emissions and then dumped them into CVG liquidity pools, Convergence said.

Convergence 表示，攻击者随后铸造了所有专门用于质押排放的代币，然后将它们转储到 CVG 流动性池中。

Related: Over 70% of hacked funds are lost to CeFi entities — Cyvers

相关：超过 70% 的被黑资金都流向了 CeFi 实体 — Cyvers

Convergence says that user funds are safe, but has advised users to withdraw assets from the platform.

Convergence表示用户资金是安全的，但已建议用户从平台提取资产。

“Due to the exploit, the rewards contract for the Stake DAO integration is currently broken. It will be fixed, and stakers will be able to claim their rewards once it’s done. No rewards are lost for Stake DAO integration users,” it said.

“由于该漏洞，Stake DAO 集成的奖励合约目前已被破坏。该问题将被修复，一旦完成，质押者将能够领取奖励。 Stake DAO 集成用户不会损失任何奖励。”

Convergence works to aggregate liquidity, boost returns and enable liquid locking across the Curve Finance ecosystem.

Convergence 致力于聚合流动性、提高回报并实现整个 Curve Finance 生态系统的流动性锁定。

The total value locked on Convergence fell from $5.79 million to $3.69 million, DefiLlama data shows.

DefiLlama 数据显示，Convergence 锁定的总价值从 579 万美元降至 369 万美元。

The cryptocurrency ecosystem lost around $266 million to hacks in July, largely due to the $230 million hack of Indian trading platform WazirX on July 18.

7 月份，加密货币生态系统因黑客攻击损失了约 2.66 亿美元，这主要是由于 7 月 18 日印度交易平台 WazirX 遭受了 2.3 亿美元的黑客攻击。

Magazine: THORChain founder and his plan to ‘vampire attack’ all of DeFi

杂志：THORChain 创始人及其“吸血鬼攻击”整个 DeFi 的计划