https://t.co/0oY7BaKehe

🔗 Related Info: Attacker: 0x657CDEfc7ef8b459b519dEFc8BED2A67d3cC1aAb Exploited Contract: 0x3c212A044760DE5a529B3Ba59363ddeCcc2210bE

⚠️ Key Takeaways 1️⃣ Oracle config changes MUST be rigorously tested 2️⃣ Price precision handling is critical for DeFi security 3️⃣ Contract upgrades need comprehensive audit processes 4️⃣ Even small config changes can lead to massive losses DeFi protocols must maintain extreme

📉 Assets Extracted by Attacker: - 299.48 WETH - 343.87 wstETH - 178,073.77 USDC - 2.5498 WBTC Total profit: 846.18 ETH ≈ $2.74M All affected assets suffered from the same oracle precision issue 💸

💥 Attack Breakdown Example tx: https://t.co/FFUIOUiw5E Oracle returned stETH price: 3.246e10 Actual price should be: 3246 Result: 1 oToken could redeem 9,986,072 WETH ❌ Attacker used only 0.00002999 oToken to extract 299.48 WETH ✅

🔍 Root Cause: Oracle Precision Misconfiguration 6 days prior, developers updated oracle configs for stETH, Aave, PAXG, and LINK, but incorrectly changed the price precision Issue: Oracle returned prices with different precision, but redemption calculations still used the

🚨 @ribbonfinance suffered a major exploit losing ~$3M On Dec 12, the structured finance platform was attacked due to oracle price precision misconfiguration. Attacker profited 846.18 ETH (~$2.74M) A classic case of oracle configuration failure 🧵👇

Night, everyone! What cool #GoPlus stuff are you rocking? Show me in the replies! 🌙

✋AI Safety Rules ✓ Manual confirm all payments/transactions ✓ Never input ID/passwords ✓ Audit & revoke risky permissions regularly You're the human in the loop. AI assists — YOU decide. 🛡️

Appreciate the analysis! 🙏 Every dollar of revenue represents a user we've protected, a scam we've prevented, or a project we've secured. Sustainability means we can keep building, and keep innovating for the long term. Thank you for being part of this journey 💙

I swapped out one of my keyboard keys for G's "✅" key. Now it's your turn: Install the #GoPlus extension and secure your Web3. 🔐 https://t.co/XLZNw2lene

Onchain security products live or die by real-time data. That’s why @GoPlusSecurity uses Moralis Data APIs to fetch onchain data & Moralis Streams to monitor live onchain data for their leading Web3 security layer⭐️ More speed. Less infra. Big savings. https://t.co/QTvs0GHDLV

6️⃣ Addresses Involved 🧨 Exploit addresses 0x7C97313f349608f59A07C23b18Ce523A33219d83 0x083379BDAC3E138cb0C7210e0282fbC466A3215A 🛠️ Malicious contracts 0xc2a0aD4Bd62676692F9dcA88b750BeC98E526c42 0xAC075b9bf166e5154Cc98F62EE7b94E5345Cc090

5️⃣Stage 2 📆Dec 5 Attacker used admin rights to trigger the actual exploit: Tx: https://t.co/w7wQyGPx5M Steps: ① Upgrade implementation → attack contract → drain 232 stETH ② Flash-loan 3121 ETH → mint ~98M USDP ③ Swap part of USDP → ~300k USDC ④ Repay the flash loan →

4️⃣Attack Timeline: Two Stages 📆Sept 16 Attacker leveraged Multicall3 to execute a frontrunning initialization: Tx: https://t.co/8439GTGqKb Actions: ① Initialize proxy → gain admin access ② Upgrade implementation → malicious proxy ③ Upgrade again → back to original logic

3️⃣ Key Technique: Malicious Proxy Injection The attacker inserted a malicious proxy contract between: ERC1967Proxy (0x1346B4) ↔ StabilizerNFT (implementation) This layer: 🔹 Preserved original business logic 🔹 Granted attacker hidden admin access 🔹 Spoofed the

2️⃣ Root Cause The proxy contract allowed initialize() ⚠️ without restricting the caller (e.g., onlyOwner). The attacker monitored mempool & front-ran the initialization, gaining admin privileges over the proxy. → When the team later performed initialization, they were

The @USPD_io stablecoin protocol on Ethereum was exploited via a proxy initialization frontrunning attack.🧵 The attacker waited 80 days before triggering the exploit, stealing 232 $stETH + 300k $USDC (~$1M total).

📊 GoPlus November Web3 Security Monthly Report Released A staggering $183.9M lost as exploits, phishing and scam tokens intensified in November Understand the risks to protect your assets👇

https://t.co/6pDmO49hV3

🛡️ GoPlus Extension X Detection - Demo Walkthrough Don't wait until it's too late, install #GoPlus Extension now and secure your #Web3 social experience! https://t.co/XLZNw2lene