DeFi security incidents resurface, GMX urgently clarifies its position
Another security vulnerability has emerged in the DeFi space! Blockchain security firm PeckShield has revealed that the lending protocol Abracadabra/Spell's "Cauldron" smart contract has been attacked, resulting in the theft of 6,260 ETH (approximately 13 million USD).
It is worth noting that this incident has affected the well-known decentralized exchange GMX, as Abracadabra's contract is directly connected to GMX V2's liquidity pool.
The GMX team quickly issued a statement to clarify the distinction, stating that their contract is absolutely secure! They explained that the issue lies solely within Abracadabra's contract design and is unrelated to GMX's underlying protocol.
Currently, the Abracadabra team is working with external security experts to trace the source of the vulnerability. This is the second time this year that the protocol has been compromised; in January, its stablecoin MIM lost over 6.49 million USD due to a contract vulnerability.
Security researcher Weilin Li analyzed the attack process and revealed the "flash loan seven-hit combo" strategy used by the hacker. The attacker executed 7 operations in a single transaction, borrowing MIM stablecoins 5 times and rapidly accumulating debt.
Because the contract did not check the collateral ratio in real-time after each loan, the attacker's debt ratio quickly exceeded the safe threshold. Subsequently, the attacker invoked a malicious contract, triggering a liquidation against themselves within a brief window before the flash loan was repaid.
In simple terms, the attacker first borrowed MIM stablecoins to increase their debt, then triggered the liquidation mechanism while in the flash loan state, at which point the system could not detect the insufficient collateral. Even more shocking is that the contract's payment accounting function was executed only after all operations were completed, which provided the attacker with an opportunity!
This incident once again reminds us that to avoid similar arbitrage attacks, DeFi protocols must be strictly designed with real-time risk control logic. Furthermore, the security of smart contracts depends not only on the code itself but also on the reasonable setting of boundaries for financial behavior.
Will incidents like this affect your confidence in DeFi? How do you balance yield and security considerations in the use of DeFi protocols?
#DeFi安全 #GMX #Abracadabra #闪电贷攻击