Unizen a DEX aggregator, experienced a significant security breach resulting in a theft of approximately $2.2 million. The attack, which targeted the platform's smart contract, is attributed to a vulnerability within its trade aggregator operating on the Ethereum blockchain.
Behind the Breach
The breach was caused by a vulnerability related to an unchecked external call within the newly upgraded DEX aggregation contract. The Unizen team responded to the incident by pausing the affected smart contract within fifteen minutes of detecting the attack, although the funds had already been extracted by then. In an attempt to mitigate the damage and possibly recover the stolen funds, the team engaged with the attacker through on-chain messages, offering a 20% bounty and later threatening legal action.
Lessons from the Incident
This hack serves as a critical reminder of the vulnerabilities present in smart contracts, especially those related to external calls. The swift response by the Unizen team in pausing the contract and their attempts to negotiate the return of stolen funds highlight the importance of rapid action and communication in the aftermath of a breach. To mitigate similar vulnerabilities, platforms should conduct multiple thorough audits and security assessments of smart contracts, particularly focusing on the handling of external calls and the implementation of robust authorisation checks.
Rivanorth is a boutique Web3 cybersecurity company. We specialise in smart contract audits and blockchain security advisory. Visit rivanorth.com to find out more.
You build the future. We help you secure it.