Sonne Finance 遭受 2000 万美元黑客攻击，SONNE 代币崩溃

在去中心化借贷协议遭受价值 2000 万美元的黑客攻击后，Sonne Finance 的 SONNE 代币暴跌 60% 至 0.025 美元，黑客利用“捐赠”攻击操纵市场。该漏洞与该平台的 Optimism 区块链隔离，允许攻击者在被破坏之前窃取各种代币。开发商声称已追回 650 万美元，并正在积极追捕黑客。

Sonne Finance Reels from $20 Million Hack, SONNE Token Plummets

Sonne Finance 遭受 2000 万美元黑客攻击，SONNE 代币暴跌

Sonne Finance's SONNE token has taken a nosedive following a sophisticated hack that siphoned $20 million from the decentralized lending protocol in the early hours of Wednesday. Amidst the market turmoil, developers have revealed the extent of the breach and are actively pursuing avenues to recover the stolen funds.

Sonne Finance 的 SONNE 代币在周三凌晨遭受一次复杂的黑客攻击后，从去中心化借贷协议中窃取了 2000 万美元。在市场动荡的情况下，开发商已经透露了违规的严重程度，并正在积极寻求追回被盗资金的途径。

The SONNE token has witnessed a sharp depreciation, shedding over 60% of its value to a mere 2.5 cents, marking its lowest point in more than a year. Despite developers' swift intervention to halt the outflow of $6.5 million, the hack has eroded the protocol's market capitalization to a mere $20 million.

SONNE 代币大幅贬值，价值下跌 60% 以上，跌至仅 2.5 美分，创下一年多来的最低点。尽管开发者迅速干预阻止了 650 万美元的外流，但此次黑客攻击已将该协议的市值侵蚀至仅 2000 万美元。

The perpetrators employed a "donation" attack, exploiting vulnerabilities in specific markets offered by the platform, allowing them to pilfer various tokens before their illicit activities were detected. The incident transpired on Sonne's platform hosted on the Optimism blockchain, while the protocol's Base blockchain version remained unscathed.

犯罪者采用“捐赠”攻击，利用平台提供的特定市场的漏洞，使他们能够在非法活动被发现之前窃取各种代币。该事件发生在 Optimism 区块链上托管的 Sonne 平台上，而该协议的 Base 区块链版本却毫发无伤。

Unraveling the Hack's Mechanics

揭开黑客的机制

The exploit unfolded following the protocol's introduction of token markets for Velodrome Finance's VELO, based on a recent community proposal. The attacker cunningly exploited a two-day timelock to execute a series of four transactions, which involved creating markets and modifying collateral factors.

该漏洞是在该协议根据最近的社区提案为 Velodrome Finance 的 VELO 引入代币市场后展开的。攻击者狡猾地利用两天的时间锁来执行一系列四笔交易，其中涉及创建市场和修改抵押品因素。

A timelock contract functions as an automated mechanism that triggers a transaction's execution at a predetermined time, in this case, two days after its initiation. The attacker leveraged this feature to execute transactions involving substantial cryptocurrency donations, manipulating the exchange rates between two tokens.

时间锁合约作为一种自动化机制，在预定时间触发交易执行，在本例中是在交易启动后两天。攻击者利用此功能执行涉及大量加密货币捐赠的交易，操纵两个代币之间的汇率。

By artfully orchestrating these transactions, the attacker duped the platform into perceiving it possessed more collateral than was genuinely available. Blockchain records indicate the attacker succeeded in transferring millions of VELO, ether, and USD Coin USDCUSD in the wake of the manipulation. Subsequently, they converted these assets into approximately $8 million worth of bitcoin and ether and rerouted the funds to a newly created wallet address in the early hours of the European trading day.

通过巧妙地安排这些交易，攻击者欺骗平台，让其认为自己拥有比真正可用的更多的抵押品。区块链记录显示，攻击者在操纵后成功转移了数百万个 VELO、以太币和美元代币 USDCUSD。随后，他们将这些资产转换为价值约 800 万美元的比特币和以太币，并在欧洲交易日凌晨将资金重新转移到新创建的钱包地址。

Sonne Finance had previously safeguarded itself against similar attacks by creating markets with zero collateral factors, manually adding and permanently removing collateral before malicious actors could exploit market fluctuations.

Sonne Finance 此前曾通过创建零抵押品因素的市场、在恶意行为者利用市场波动之前手动添加和永久删除抵押品来保护自己免受类似攻击。

Recovery Efforts Underway

恢复工作正在进行中

In an official statement regarding the exploit, Sonne Finance's developers have expressed their unwavering commitment to retrieving the stolen funds. They have also initiated a bounty program to incentivize the hacker's cooperation in returning the ill-gotten gains.

在一份关于该漏洞的官方声明中，Sonne Finance 的开发人员表达了他们对追回被盗资金的坚定承诺。他们还启动了一项赏金计划，以激励黑客合作返还非法所得。

The incident has underscored the heightened security risks associated with decentralized finance (DeFi) protocols and the urgent need for robust safeguards to protect users' funds. As the DeFi ecosystem continues to evolve, it is paramount that developers prioritize security measures and implement stringent protocols to prevent future hacks.

该事件凸显了与去中心化金融（DeFi）协议相关的更高的安全风险，以及迫切需要采取强有力的保障措施来保护用户的资金。随着 DeFi 生态系统的不断发展，开发人员优先考虑安全措施并实施严格的协议以防止未来的黑客攻击至关重要。