Recap of where we're at with Pickle:
Two hours ago, a suspicious transaction was seen involving Pickle's new pDAI jar.
$20m worth of DAI was withdrawn to an EOA, which funded the attack with 10 ETH from Tornado (mixer).
No flash loan was involved as first believed.
Two hours ago, a suspicious transaction was seen involving Pickle's new pDAI jar.
$20m worth of DAI was withdrawn to an EOA, which funded the attack with 10 ETH from Tornado (mixer).
No flash loan was involved as first believed.
At this moment, the attack vector seems to be related to a function in the Pickle controller (v4), which can swap coins from one strategy to another.
Rumor has it that there was no check on the Jar Swap function. Pickle was audited but seemingly before this function was added.
Rumor has it that there was no check on the Jar Swap function. Pickle was audited but seemingly before this function was added.
Affected users are already contacting the attacker.
The first image here shows someone, a purported "nurse," asking for $100,000 back from the attacker. The use of the nurse bit was popularized last week with the Value attack, where the attacker returned $50k to a "nurse"
The first image here shows someone, a purported "nurse," asking for $100,000 back from the attacker. The use of the nurse bit was popularized last week with the Value attack, where the attacker returned $50k to a "nurse"
We're seeing @coverprotocol respond to this in real time.
Cover launched literally two days ago, and Pickle was a project it began providing cover for. There was $430,000 in cover available last time I checked.
Community seems to think it's a valid claim already.
Cover launched literally two days ago, and Pickle was a project it began providing cover for. There was $430,000 in cover available last time I checked.
Community seems to think it's a valid claim already.
Pickle devs are telling users to withdraw funds for the time being.
I suppose it's unclear if the bug in the controller contract can be exploited on other Jars.
I suppose it's unclear if the bug in the controller contract can be exploited on other Jars.
https://twitter.com/picklefinance/status/1330256787002564610?s=19
More communication between victims and the attacker. Attacker hasn't responded or moved any funds - different than the recent DeFi attacks.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
