Key Takeaways
- ParaSwap found a smart contract vulnerability last week, but white hat hackers intervened in time to prevent major asset loss.
- The team also reached out to identified hacker addresses via on-chain messaging, urging the return of stolen user funds
ParaSwap, a decentralized finance aggregator, has moved swiftly to address a critical vulnerability discovered in its recently launched Augustus v6 smart contract. This vulnerability prompted the platform to initiate the return process for cryptocurrency assets to affected users.
Upon discovering the vulnerability, ParaSwap’s team promptly engaged with white hat hackers, who successfully recovered assets. Additionally, the platform revoked permissions to the problematic contract to prevent further exploitation.
Despite the majority of users having their assets restored, ParaSwap has identified 213 addresses that remain vulnerable due to outstanding allowances to the flawed contract. Users are urged to take immediate action to safeguard their wallets by revoking permissions.
The vulnerability came to light last week, with timely intervention from white hat hackers preventing significant asset loss. In response to the incident, ParaSwap has submitted a detailed report to authorities, initiating an investigation into the matter. Collaborating with blockchain analytics and security firms Chainalysis and TRM Labs, ParaSwap is actively tracing the movement of funds and identifying hacker addresses.
ParaSwap has also reached out to identified hacker addresses through on-chain messaging, urging the return of stolen user funds. If the hacker fails to respond by March 27, ParaSwap will pursue all available legal avenues to recover the funds.
While the losses initially amounted to approximately $24,000, the vulnerability’s discovery underscores the importance of robust security measures in decentralized finance platforms. The vulnerability was detected on March 20, shortly after the Augustus v6 smart contract’s launch. Upon discovery, ParaSwap promptly paused its API and secured funds with the assistance of white hat hackers.
