智能合约 · 9082

SAND is suspected to have experienced an infinite minting vulnerability, and attackers have minted over 500 million tokens

Comparatively, according to market news, The Sandbox's native token SAND on the Base network is suspected to have had a serious security flaw. Attackers have obtained permission to mint tokens and can arbitrarily issue additional SAND tokens. According to on-chain data, the vulnerability incident has now minted more than 500 million pieces of SAND, and the attack continues. The market is concerned that a large amount of new supply may impact the price of SAND. Currently, The Sandbox has yet to release an official response to this incident, and the cause of the vulnerability, the source of the attackers' permissions, and the whereabouts of the new tokens are yet to be further confirmed. Infinite Mint Attack (Infinite Mint Attack) is usually caused by smart contract permission control flaws or minting logic flaws. Attackers can bypass restrictions to generate large numbers of tokens, which in turn causes supply loss of control and market value dilution.

15h ago

SEC Proposes Reg Crypto: Establishing a Legal Path for the Public Offering of Some Tokens and the Withdrawal of Investment Contracts

Comparing news, Galaxy's research director posted an article on the X platform stating that the US Securities and Exchange Commission proposed the “Crypto Asset Regulation” to regulate Crypto Assets, referred to as Reg Crypto for short. The proposal aims to establish a legal path for some tokens to be issued to the US public and establish a mechanism to terminate investment contracts. The scope of application is limited to cryptographic assets that are not securities themselves but have been issued or sold as part of an investment contract. Tokenized stocks, bonds, and arrangements for bundling tokens with shares or other securities are not within the framework. The proposal establishes four stages: financing, disclosure, construction, and exit. The one-time startup exemption allows issuers to raise $5 million over a maximum period of 4 years; higher exemptions set by reference to Regulation A allow $20 million or $75 million in 12 months. Relevant financing is subject to SEC qualification review and ongoing disclosure. The maximum investment amount for uncertified investors is 10% of those with high annual income or net assets. Issuers are also required to disclose token supply and release plans, minting and destruction mechanisms, governance and smart contract authority, source code, and project construction commitments and progress. When the issuer completes or permanently suspends the relevant construction obligations, does not make new construction commitments, and submits a transition report, the relevant investment contract will be deemed terminated, and cryptographic assets will no longer be subject to the securities law under the investment contract. Issuers that have not used the above financing exemptions can also use this safe harbor. The US Securities and Exchange Commission estimates that approximately 475 issuers will use the safe haven of investment contracts each year, and about 130 issuers will use the two new exemptions. Eligible issuances may not be restricted securities and may be immediately resold without contractual restrictions. The proposal also excludes covered initial offerings and some secondary transactions from state registration and qualification requirements, but it does not involve exchanges, brokers, dealers, escrow, or independent innovation exemptions for tokenized securities and on-chain transactions. The comment period is 60 days after publication in the Federal Register. SEC Chairman Paul Atkins and members Hester Peirce and Mark Uyeda all issued statements of support.

1d ago

BounceBit Chain updates vulnerability attack progress: will permanently shut down the chain and migrate to BNB Chain

Comparatively, cross-chain revenue protocol BanceBit issued a security incident announcement stating that its blockchain network was attacked by a protocol-level vulnerability attack between 8:02 UTC on August 19 and 01:54 UTC on August 20. The attackers used authorization flaws in the Evmos underlying architecture to transfer BB tokens from 9 main network accounts without the authorization of the account owners. According to the announcement, the attackers transferred a total of approximately 286.5 million BBs through 14 transactions. The impact of the incident was limited to BanceBit Chain itself, and did not involve private key leaks, signature forgery, wallet, hardware devices, or exchange account security issues. BanceBit CeDeFi Strategy, Promo Vaults, Prime, and RWA products were not affected. BounceBit stated that the vulnerability stemmed from a protocol native module authorization verification flaw in the Evmos architecture. When calling the relevant module through a smart contract, the attackers bypass security checks that should verify the authorization relationship of the fund source account, making it possible to specify any account as the source of funds. After the incident, BounceBit Chain stopped generating blocks at block height 20,702,857, then the team decided not to upgrade the chain, but to permanently shut down Bouncbit Chain and re-issue BB as an BEP-20 token based on BNB Chain. BounceBit stated that the new BB token supply will be based on an on-chain snapshot before the first abnormal transfer (block height 20,697,260), and the 286,543,148 BBs transferred by the attackers will not be included in the new token balance. Users do not need to submit an application or migrate their wallets, and the official plan is to automatically distribute the new BB to the corresponding BNB Chain addresses. Regarding the BB in the pledge, BounceBit said it will be restored as soon as the snapshot is in time, and there is no need for coin holders to perform unbundling or redemption operations. Currently, BounceBit has submitted requests for suspension and assistance to relevant exchanges, and reminds users to be wary of scams and not to click on any BB migration or receipt links that have not been officially confirmed. The team said that the new BEP-20 BB contract address and reissue progress will be announced later. This article is sponsored by GENG, Build Your Fortune on GENG (https://geng.one)

1d agoburnking

If it's just tokenized assets and doesn't connect to DeFi, what's left of RWA?

Author: Jesus Rodriguez, co-founder of Sentora Compiled by: Luffy, Foresight News Original title: Does RWA still make sense without DeFi? Discussions in the RWA industry often begin with a simple vision: take a treasury bill, fund share, stock, invoice, megawatt hour, or GPU for one hour, then mint a token representing it. Is it useful? It's really useful. But can it be called transformative? It's far from there. This is like putting a bar code on a container and claiming that a global trade problem has been solved. Barcodes make containers recognizable and machine-readable, but they don't create ports, cranes, customs, insurance, financing, shipping routes out of thin air, or bring in buyers from afar. A token is simply an addressable token of interest, and DeFi is a marketplace operating system. The question really worth discussing is not how many types of assets can go on the chain, but how many assets can complete valuation, financing, hedging, transaction monetization, and loss disposal in a stressful environment, and there is no need for offline meetings and coordination every time a transaction occurs. Tokenization completes the representation of equity; what DeFi brings is actual utility. Tokenization is just a bar code, and a similar scene has happened in the history of the supply chain finance market. The reason why mortgages can be scaled up is not as simple as turning a paper document into an electronic record. To actually achieve large-scale expansion, a complete set of operating mechanisms was created around this type of asset: credit review, post-loan services, securitization, credit rating, warehousing and financing, repurchases, hedging, clearing and settlement, and loss allocation rules. RWA also needed to go through the exact same evolutionary process. An asset that can be adapted to DeFi requires six levels: legally enforceable rights, reliable data sources, clear transfer and redemption rules, enforceable secondary market liquidity, collateral parameters that match actual behavior, and a credible settlement and loss disposal path. Most tokenization projects, on the other hand, tend to stop at the top five levels. There is a simple test that can be used to test the maturity of an asset. It only requires answering three questions: How much is this asset currently worth? Can the agreement complete withdrawal and monetization at this point? If the first two judgments are all wrong, who bears the loss? When smart contracts can definitively answer the above three questions, RWA can truly become a basic component of finance. Before that, it was mostly just a digital packaging shell. The deepest technical contradiction of RWA's quadruple time clock is that RWA runs under multiple sets of different time clocks at the same time. The blockchain can complete settlement in seconds and operate uninterrupted for 7 x 24 hours; oracles may update prices every hour or every day; underlying traditional exchanges are closed at night and on weekends; custodians follow bank working days; and the asset redemption process may take 1 day, 5 days, or even 30 days. If you use such a slow-paced RWA asset to support fast-maturing DeFi liabilities, such as stablecoin loans. This is the term shift, and it is also the core model that banks have relied on for hundreds of years: using short-term debt to fund long-term slow assets. This model has practical value, but the risk must be reasonably priced. Imagine a scenario: At 2 a.m. on Sunday, assets hit the liquidation threshold. Smart contracts can seize tokens immediately, but the underlying real-world market won't open until Monday, and the issuer's redemption business will not be processed until Tuesday. On-chain liquidation has been completed, and real-world asset disposal has only just begun. This creates a clearing gap. DeFi requires immediate withdrawal for monetization, but the real world does not allow it. The time difference between the two. This gap has counterintuitive consequences. Even treasury bonds with very low volatility are riskier than native crypto assets that are more volatile when used as collateral. The price of ETH fluctuates drastically, but it can be traded around the clock; the price of RWA assets appears to be stable, and it may only be up to a dozen hours without a new price tag. A flat price sometimes represents safety, and sometimes it's just a disguise of stale data. Liquidity is an exit channel, not TVL. The digital public also has common misunderstandings about liquidity. Liquidity is not equal to TVL, does not equal the existence of a trading pair, nor does it mean that the issuer promises to eventually redeem it according to net worth. Liquidity refers to the ability to convert a position into the settlement asset you need at an acceptable discount within the time window allowed by your debt. Take a crowded theater for example: the size of the hall cannot determine whether it is safe in the event of a fire; what really matters is the width of the exit channel. One copy of RWA to...

1d agoForesight News#DeFi #RWA

Black eats black? Fake DeFi actually snatched out North Korea's Lazarus real hacker

Source: Security Company ANY.RUN Compiled by: Daily Planet Daily Original title: Fishing Show of the Year, Fake DeFi Picks Out North Korea's Lazarus, Real Madrid Fans, Real Madrid Fans. With a mathematical background, they only use AI to write code. Core point of view: By setting up a fake DeFi company, the security agency successfully infiltrated the “Famous Chollima” hacker group under North Korea's Lazarus Group, revealed its complete process of using false identities, AI tools, and remote collaboration to infiltrate Western companies, and revealed its evolving toolset and infrastructure. Key element: The researchers disguised themselves as recruiters and recruited three North Korean agents within a few months to record their operation behavior, tool usage, and collaboration patterns in real time through the ANY.RUN sandbox environment. Agents used forged driver's licenses, stolen social security numbers, and mule accounts to complete the onboarding process. Some of these documents were processed by Google Gemini and had SynthID watermarks, revealing signs of forgery. Attackers rely on AI tools such as ChatGPT and Google Gemini to encode, translate, and modify files, and use AstrillVPN, remote desktop software, and dedicated servers to covertly access corporate environments. The three agents showed insufficient skills during development, frequently searched for basic issues, and exposed more proxy server and infrastructure information induced by selective network outages and captcha. The investigation found that Famous Chollima aims to lurk within the enterprise for a long time and legally obtain access to code, systems, and intellectual property rights, and is not limited to short-term attacks, and the threat persists significantly. Crypto friends who are often phished have probably heard of the North Korean hacker group Lazarus Group. Its well-known “campaigns” include, but are not limited to: Bybit ($1.5 billion) theft, Ronin Network/Axie Infinity Bridge attack ($6.2 billion), DMM Bitcoin/Ginco related attack ($308 million), Harmony Horizon Bridge attack ($100 million), and Atomic Wallet attacks ($100 million), etc. And the key to the success of these attacks is social engineering — hackers usually disguise themselves as normal job applicants, lurk at crypto companies for years, and wait for the right time. Recently, security agency ANY.RUN joined forces with BCA LTD (a company dedicated to threat intelligence and hunting) and NorthScan (a threat intelligence program to uncover the infiltration of North Korean IT workers) to effectively crack down on North Korean hacker agents. The researchers created a fake DeFi startup and successfully recruited “Famous Chollima” agents under North Korea's Lazarus Group who specialize in human infiltration, to gain an inside perspective on the actions of North Korea's IT workers. The ANY.RUN sandbox environment shows the agent's behavior patterns in real time, revealing their evolving toolsets, remote access workflows, AI tool usage, and supporting infrastructure. This survey went beyond the simple recruitment process and showed in depth how these agents collaborated, obtained, and used company resources after joining the company. The findings suggest that the North Korean IT worker program not only poses a recruitment risk; once agents sneak inside the organization, they can legally obtain access to code, systems, intellectual property, and critical business processes. The following is a report co-authored by the three parties, compiled by Daily Planet Daily. ——————Introduction In December of last year, we fully recorded the infiltration cycle of “Famous Chollima” for the first time. From recruiting collaborators to help them join Western companies, to falsifying documents, shipping laptops to intermediaries, and even using AI tools to assist and translate in real time during interviews, everything is under control. In that survey, we pretended to be a middleman willing to interview them and lend them a laptop in exchange for a percentage of their salary. The point is that those laptops are actually ANY.RUN sandbox environments that record every click and every step they take. This provided us with massive metrics, hours of computer operation videos, and face-to-face contact images, making an unprecedented survey and making headlines in many media. (“Famous Chollima...

1d agoOdaily星球日报#wallet security #hacks

Sun Yuchen's WLFI dispute was upheld by the court, and individual claims will be tried publicly

Comparing news, Sun Yuchen wrote that his lawyer recently appeared in California federal court to oppose World Liberty Financial (@worldlibertyfi)'s request to forcibly transfer the dispute between the two parties to confidential arbitration and seal the documents. The court ruled that all of Sun Yuchen's individual claims would continue to be tried in open court; at the same time, it rejected the opinion that all company-related claims should be submitted to arbitration, and requested both parties to negotiate to determine which claims remained in court and which went to arbitration. Sun Yuchen called this a major victory, stressing that token holders have the right to understand how the project treats their trusters. Sun Yuchen said that as one of World Liberty's earliest and largest investors, it invested 45 million dollars to obtain $WLFI tokens. The lawsuit alleges that after the investment helped raise about 550 million US dollars in token sales, the project party secretly implanted a back door in the smart contract, which could unilaterally freeze, restrict, or destroy holders' tokens, and illegally seize their tokens based on this, and also threatened criminal reporting when defending their rights. The lawsuit claims amount to hundreds of millions of dollars. He has previously obtained a court injunction prohibiting the other party from destroying and disposing of his tokens. Sun Yuchen also said that World Liberty also implants similar backdoor capabilities into its USD1 stablecoin, and mentioned public information such as the project party's use of a large amount of $WLFI tokens as collateral for Dolomite loans and past Dough Finance-related lawsuits by the co-founder, expressed concern about the solvency and transparency of the project, and called on investors to exercise due diligence and caution. The above are all unilateral statements and accusations.

1d ago

BounceBit Chain suspended block repair due to a fault, and the chain upgrade was carried out on August 23

Comparing news, BanceBit posted an article on the X platform saying that the team discovered a problem affecting the BounceBit Chain, suspended node deployment and repair procedures, and BB transactions and exchange deposits and withdrawals are temporarily unavailable. Officials emphasized that the problem was limited to the chain itself. CeDeFi applications, smart contracts, and vaults were not affected, and no private keys were leaked or users' wallets were damaged. The chain upgrade is scheduled for August 23 at 17:00 UTC+8.

2d ago

Gnosis Chain received approval from GnosisDAO to transform into an EEZ Rollup, which will be the first production-level instance

Comparatively, GnosisDAO approved the transformation of the blockchain network Gnosis Chain from an independent Layer 1 network to an Ethereum Economic Zone (EEZ) Rollup with zero knowledge certification. The network will eliminate the set of independent validators and let Ethereum validators complete transaction settlement instead. The proposal received 123,158 GNOs in favor, 115 against, and 151 abstentions. The vote involved 54 participants, and the total number of participants reached 123,425 GNOs, which is above the quorum threshold of 75,000 GNOs. The upgrade is initially scheduled to begin in late 2026 or early 2027, depending on EEZ technical preparations. After the upgrade, Gnosis Chain's native smart contract can call Ethereum and use return results in the same transaction, while also connecting to Ethereum mainnet assets and liquidity. Gnosis Chain will be the first EEZ instance to be deployed and will preserve existing apps, balances, and xDAI fuel tokens.

2d ago

Sherlock launches Audit Engine, an AI-native security audit engine

According to Twitter, blockchain security audit platform Sherlock today announced the launch of Sherlock Audit Engine. The engine integrates today's strongest AI security methods into a collaborative review process and aims to launch a new phase of AI-native security auditing. Sherlock said the team has spent months building the engine in a private environment and testing it against high-risk code. The Audit Engine is now officially launched to conduct coordinated AI security reviews of smart contracts and other codes.

4d ago

South Korean regulators blocked access to Polymarket and determined that it provided illegal contests

Comparatively, the Korea Broadcasting and Communications Review Committee (KCSC) held a Communications Review Subcommittee meeting today, determined that the overseas prediction market platform Polymarket provided illegal contests, and decided to block access to it. The committee determined that Polymarket's business model is based on the results of events beyond the user's control, such as politics, sports, elections, weather, etc., and uses a winner-take-all profit and loss structure to promote speculative mentality; the platform operator is responsible for market establishment, transaction rule setting and overall operation management, and provides a virtual asset acceptance and settlement system, which actually forms an environment for collecting and delivering user funds, and collecting processing fee profits through share transactions violates South Korea's Criminal Code and National Sports Promotion Law. Polymarket has argued that the platform operates on non-custodial peer-to-peer transactions and smart contracts, and does not directly raise capital, manage funds, or issue voting rights for sports promotion. However, the Commission responded that the application of domestic laws in South Korea cannot be circumvented on the grounds of whether to provide Korean-language services, decentralized technology, or centralized transaction interfaces. Since the platform has actually provided illegal quizzes to Korean users, access blocking is unavoidable in order to protect domestic users.

4d ago