Curio, a project focused on facilitating liquidity from real-world assets for firms, recently experienced a smart contract exploit related to a vulnerability in voting power privileges. The exploit allowed an attacker to mint an additional 1 billion CGT tokens, resulting in the hacker obtaining CGT tokens worth almost $16 million. The Web3 security firm Cyvers identified the vulnerability in the permissioned access logic as the root cause of the hack. Curio notified its community of the exploit and assured them that they are actively addressing the situation, with only the smart contract on the Ethereum side being affected, while contracts on Polkadot and Curio Chain remained secure. The team released a post-mortem report outlining the flaw in voting power privilege access control that led to the unauthorized minting of a large quantity of CGT tokens.
In response to the exploit, Curio announced recovery plans and a compensation program for affected users. They stated that white hat hackers who helped them recover the lost funds could receive a reward equivalent to 10% of the recovered funds. All funds affected by the attack would be returned to the affected parties, with the creation of a new token called CGT 2.0 to be used for restoring 100% of the funds for CGT holders. Additionally, a fund compensation program for liquidity providers affected by the exploit was outlined, to be conducted in four stages lasting 90 days each, with compensation paid in USDC or USDT amounting to 25% of the losses incurred by the second token in the liquidity pools. This staged approach suggests that total compensation may take up to one year to complete.
In February, losses due to hacks and scams in the decentralized finance sector decreased to around $67 million, halving the figure from January. Most losses were related to hacks of the gaming platform PlayDapp and the decentralized exchange FixedFloat, which collectively lost $58.45 million. Additionally, cryptocurrency casino Duelbits suffered a loss of $4.6 million due to a compromised private key. The overall decrease in losses in February indicates some improvement in security measures within the DeFi sector, although vulnerabilities still exist that can be exploited by attackers.
The vulnerability in the permissioned access logic that led to the Curio exploit highlights the importance of robust security measures in smart contracts and decentralized platforms. Projects like Curio must continuously assess and update their security protocols to prevent such exploits in the future. The prompt response from Curio in addressing the exploit and the commitment to compensating affected users demonstrate a responsible and transparent approach to handling security incidents. The collaboration with white hat hackers to recover lost funds further emphasizes the importance of community involvement in maintaining the integrity of decentralized projects.
As the decentralized finance sector continues to grow, security remains a paramount concern for users and projects alike. While the decrease in losses in February is a positive development, it is essential for all DeFi projects to prioritize security and implement stringent measures to protect user funds. The ongoing fund compensation program for Curio liquidity providers affected by the exploit is a step towards rebuilding trust and mitigating the impact of the incident. By learning from such exploits and strengthening security measures, the DeFi industry can progress towards a more secure and resilient ecosystem for all participants.
