The value of total value locked (TVL) in DeFi protocols rose to $51.5 billion. Led by Lido with $20.7 billion, the second and third spots are held by Maker ($8.4 billion) and JustLend ($6.5 billion), respectively.<\/p>\n TVL in Ethereum applications \u0432\u044b\u0440\u043e\u0441<\/a> to $28.4 billion. Trading volume on decentralised exchanges (DEX) over the last 30 days \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b<\/a> $77.1 billion.<\/p>\n Uniswap continues to dominate the non-custodial exchange market \u2014 it accounts for 55.7% of total turnover. The second DEX by volume is PancakeSwap (15.1%), the third is Trader Joe (8%).<\/p>\n According to SlowMist, during a swap on the platform users authorize a TokenApprove contract, which then transfers the user’s tokens.<\/p>\n The ClaimTokens function enables a trusted DEX proxy server to call it. The servers are run by administrators who can modify the smart contract at will.<\/p>\n On December 12, the owner of one of the servers updated it, allowing direct invocation of ClaimTokens to transfer users’ tokens. The attacker exploited this vulnerability.<\/p>\n As a result of an ‘erroneous scenario’ multisig<\/a>-transaction, DeFi protocol Yearn Finance lost<\/a> 63% of treasury funds in the yCRV LP pool.<\/p>\n The incident occurred during the ‘routine process of converting fee tokens’ and led to the exchange of 3,794,894 yCRV for 779,958 yvDAI. The team clarified that losses amounted to $1.4 million.<\/p>\n The yCRV liquid-staking<\/a> token presents Curve CRV in the protocol’s pool. The project allocates funds within the structure to maintain liquidity and earn revenue from fees.<\/p>\n However, due to a glitch in the exchange script for the DEX CoW Swap, all treasury funds were sent to a single one of the protocol’s largest pools. The trade caused significant price slippage, which ‘arbitrageurs and other market participants’ exploited.<\/p>\n Developers explained that the erroneous transfer of the entire Yearn Finance balance in the pool was one of 30 orders executed via multisig transaction<\/a>. This hindered manual oversight, and the swap script ‘lacked sufficient withdrawal checks and contained a logic error’ in capping the swap size.<\/p>\n To prevent similar incidents, Yearn Finance adopted a series of safeguards, including:<\/p>\n On December 14, SafeMoon’s attorney Mark Rose filed for bankruptcy<\/a> for the DeFi project. The SFM token reacted with a sharp drop.<\/p>\n Chapter 7 bankruptcy filings have been submitted to the United States District Court for the District of Utah. SafeMoon US LLC valued its assets at between $10 million and $50 million, while liabilities were between $100,001 and $500,000.<\/p>\n In the wake of the news, the SFM token collapsed to around $0.000055. Over the past week the coin has fallen 22.4%, according to CoinGecko<\/a>.<\/p>\n The hacker responsible for the Nirvana Finance yield-farming protocol breach and an unnamed DEX pleaded guilty<\/a> and agreed to forfeit stolen assets worth $12.3 million.<\/p>\n According to the U.S. Attorney’s Office, in the summer of 2022, 34-year-old senior security engineer Shaki Ahmed exploited a vulnerability in the smart contract of an unnamed exchange.<\/p>\n A few weeks later he attacked Nirvana Finance<\/a> using an instant loan<\/a> and withdrew $3.49 million in crypto from the project’s treasury. Although protocol developers offered the hacker a bounty, the parties did not reach an agreement. The stolen funds were swapped for Monero and laundered through Samourai Whirlpool mixer.<\/p>\n In July Ahmed was charged with wire fraud and money laundering. In addition to forfeiture of the stolen cryptocurrency, he was ordered to pay $5 million in restitution to victims.<\/p>\n The final sentence will be handed down on March 13, 2024. Ahmed faces up to five years in prison.<\/p>\n Also on ForkLog:<\/p>\n The decentralised finance (DeFi) sector continues to attract heightened attention from crypto investors. ForkLog has compiled the key events and news from recent weeks in this digest.<\/p>\n","protected":false},"author":1,"featured_media":88351,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1299,1233],"class_list":["post-88350","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-defi-bulletin","tag-industry-digests"],"aioseo_notices":[],"amp_enabled":true,"views":"19","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/88350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=88350"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/88350\/revisions"}],"predecessor-version":[{"id":88352,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/88350\/revisions\/88352"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/88351"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=88350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=88350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=88350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Snimok-ekrana-2023-12-16-v-12.47.33\"](\"https:\/\/forklog.com\/wp-content\/uploads\/Snimok-ekrana-2023-12-16-v-12.47.33-1024x581.png\")
OKX DEX suffered an exploit worth $2.76 million<\/a> in what PeckShield analysts described as damage stemming from an alleged leak of the proxy-server administrator private key.<\/strong><\/h2>\n
Yearn Finance loses $1.4 million due to a transaction error<\/strong><\/h2>\n
\n
DeFi project SafeMoon files for bankruptcy<\/strong><\/h2>\n
![\"Snimok-ekrana-2023-12-16-v-14.05.51\"](\"https:\/\/forklog.com\/wp-content\/uploads\/Snimok-ekrana-2023-12-16-v-14.05.51-1024x640.png\")
Nirvana Finance hacker agrees to return $12.3 million<\/strong><\/h2>\n
\n