More Markets Exploit: $9.3M Drained From WFLOW Token

[_act_]

More is a DeFi lending protocol which was exploited recently. The hackers behind the exploit stole 15.5 million WFLOW ( which is approximately $9.3 million) from the mFlowWFLOW reserve.

According to where I read it, on-chain traces show stolen funds were moved and bridged off-chain, the team is investigating with no recovery announced, and market reaction pushed WFLOW down ~9% and FLOW ~8.7% to $0.0262.

https://cryptorank.io/news/feed/47fcc-more-markets-exploit-9-3m-drained-from-wflow-token

[asriloni]

It's all rooted from the vulnerability on minting contract of ankrFLOW liquid token. The vulnerability let attacker to mint ankrFLOW, then he supply it as collateral to borrow wflow. It's just the same attack with the previous Kelpdao hack where the hackers were minting so many unbacked tokens just to supply it as a collateral to withdraw the funds pooled.

At this point, i can only come to the solution if the liquid token minting should have done manually through use some verifications. Using contract for minting purpose is a very risky decision. I hope the developers will think to change their mechanism. So there will be no more attack to the contract to mint the liquid token, then used it as a collateral attack to the vault.

Decentralization is good, but human can't rely upon the contract that might have undiscovered vulnerability. Do we need to wait until dozens of projects get hacked by the same method? I hope the developers aware of this serious problem.

They have to solved this if they care to the people's money.

[Jostle]

If anything goes, this just shows that DeFi carries significantly more risks than it claims to have. In terms of comparison with CeFi, both carried risks but are of different nature.  "Not your keys, not your crypto" cannot be more true than now (hold your own coins in your own wallet and don't put them in any CeFi/DeFi).