Alchemix: alETH/ETH curve pool suffers an attack with losses of approximately 5000 ETH, but Alchemix treasury funds are safe
ChainCatcher news, DeFi lending protocol Alchemix tweeted that Curve Finance notified Alchemix that their alETH/ETH pool could be attacked due to a vulnerability in Vyper. Alchemix quickly removed the AMO-controlled liquidity from the Curve pool through the AMO contract. The vulnerability was executed on the Curve pool contract. Alchemix's smart contracts were not attacked, and the funds are safe.The process requires three transactions: withdrawing LP tokens from Convex, extracting alETH from the Curve pool, and withdrawing ETH from the Curve pool. The first transaction to unstake LP tokens from Convex has been executed, and after the second transaction, 8000 ETH was removed from the Curve pool. There is still about 5000 ETH of liquidity controlled by AMO in the Curve pool. During the process of removing the remaining liquidity, the alETH/ETH Curve pool was attacked by an attacker. Currently, the alETH reserves have lost approximately 5000 ETH.For users, the funds in the Alchemix treasury are safe, and all Alchemix contracts are unaffected. Providing liquidity in the alETH/ETH Curve pool is unsafe. Providing liquidity for alETH elsewhere is technically safe, but attackers may exploit this liquidity to sell alETH for ETH. The fair price of alETH is currently unknown, and any users holding alETH or LP alETH face this uncertainty. Alchemix advises any LPs providing liquidity in the alETH pool on the decentralized exchange Saddle Finance and the frxETH pool on Curve to withdraw their liquidity as soon as possible.