The DeFi liquidity protocol RocketSwap on the L2 Base network was subjected to an attack, resulting in the attacker withdrawing around 471 ETH (~$870,000 at the time of writing).
As a result of the investigation, we regret to report that the team had to use offline signatures when deploying the launchpad and storing private keys on the server, the developers said.
Representatives of the project noted that the breach of the proxy server occurred by brute force — that is, by simply trying out combinations.
Through the exploit, the hacker minted 90 trillion LoveRCKT tokens before transferring them to the decentralized exchange Uniswap.
The protocol halted farming pools to prevent further damage.
Later, the developers shared further plans to resolve the situation. First, RocketSwap will deploy a new farming contract with open-source code. The project team will also cease independently issuing new tokens and will retain only low-risk permissions for distributing new pools.
In the near term, the protocol will contact the alleged hacker and offer a bounty for returning the stolen funds.
Earlier in August, DEX LeetSwap on the Base network announced the suspension of operations amid concerns about a probable hack. According to PeckShield analysts, about 340 ETH (~$630,000) were withdrawn from several of the exchange’s liquidity pools.