The Ethereum re-staking pool Astrid was attacked, and the smart contract has been suspended while compensating users for their losses

ChainCatcher news, the Ethereum liquidity re-staking pool Astrid announced that its smart contract was attacked. Astrid has paused the contract, taken a snapshot of all holders, and will provide full compensation.

Subsequently, Astrid released a compensation statistics table for deposit users and liquidity providers (excluding internal deposits from the internal team). Liquidity providers will be compensated in the form of staked ETH tokens. Astrid later updated that all user losses have been compensated, and the smart contract will remain paused. The transaction explorer Phalcon analysis indicated that Astrid was attacked due to a flaw in the withdrawal function. The parameters of the withdraw() function (i.e., token address and token amount) could be manipulated. The specific attack process is as follows:

1. Create 3 fake tokens: A, B, and C.
2. Withdraw using fake token 1 and receive stETH.
3. Withdraw using fake token 2 and receive rETH.
4. Withdraw using fake token 3 and receive cbETH.
5. Convert stETH, rETH, and cbETH to ETH.