Security Team: There is a risk of malicious proposals in the yVaren project, please pay attention to protect the safety of funds.

[Security Team: There is a risk of malicious proposals in the yVaren project, please pay attention to protecting the safety of funds] Jinse Finance News, information from members of the Chengdu Lianan community shows that someone in the yVaren project initiated a malicious proposal (proposal ID: 0). Chengdu Lianan Security Team analyzed and found that: through this proposal, all VRN tokens in the yVaren project vault can be authorized to the proposer (0xc59d7e226c8f222e2142bf0f4b3efa83370f8cab). If the proposal is implemented, the proposer can transfer all VRN tokens in the vault. At present, the proposal has not yet been implemented, please pay attention to protect the safety of funds.

According to previous reports, Varen said that a malicious actor intends to empty the deactivated vault, and VRN pledged users should withdraw as soon as possible.

Other news:

Security Team: A giant whale withdraws 2,000 BTC from MakerDAO: Jinse Finance reported that, according to Paidun monitoring, a giant whale extracted 2,000 BTC from MakerDAO. [2022/11/25 8:06:37]

Security Team: The Discord server of the Astrobot Society project was attacked: Jinse Finance News, according to CertiK monitoring, the Discord server of the Astrobot Society project was attacked, and the attacker released a phishing link. Community users please do not click on the link, mint or approve any transactions. [2022/9/27 22:33:59]

Security team: The Acala project has modified the reward ratio of the aUSD pool, which has caused the rewards of the pool to be magnified: On August 14th, the Polkadot ecological project Acala caused additional issuance of aUSD due to incorrect settings on the chain. The following is the analysis of the SlowMist security team:

1. The project party called update_dex_saving_rewards at 2022-08-13 22:23:12 (+UTC) to modify the reward multiplier of the aUSD pool to 500000000000000000.

2. The accumulate_dex_saving function will be called in the hook function on_initialize of the block. In the function, the total amount of rewards in the pool is multiplied by dex_saving_reward_rate by dex_saving_reward_base. Since the dex_saving_reward_rate has been amplified in the previous step, the rewards in the pool are also amplified.

3. Finally, the user received the wrong reward. [2022/8/14 12:24:52]