ChainCatcher news, the machine intelligence network Spectral released a post-incident report stating that its Syntax platform experienced a security vulnerability attack on December 1. Spectral stated that it has identified and fixed the vulnerability in the Bonding Curve contract to prevent similar attacks in the future. Zellic has been commissioned to audit the updated contract, and SPEC tokens will be supplemented to restore the Bonding Curve to its pre-attack state. The project team indicated that the platform will resume operations after the audit is completed.

ChainCatcher news, according to The Block, Forta is a Web3 security company supported by a16z crypto, Coinbase Ventures, and other investors, which has now launched a new product called Firewall to help detect and prevent smart contract vulnerabilities.It is reported that this firewall uses a machine learning and artificial intelligence model named FORTRESS, which analyzes and detects high-risk transactions by examining transaction logs. The business model of the Forta firewall is to charge a fixed monthly fee, although Beal declined to disclose the specific amount. Initial clients include Euler, Plume, and Balmy.

ChainCatcher news, according to Coin98 Analytics statistics, the recently recorded top 15 cryptocurrency attack incidents have resulted in total losses of approximately $313 million.Among them, 9 attacks were caused by contract vulnerabilities, while the others were due to malware, flash loan attacks, or unknown attack methods.

ChainCatcher news, the Web3 developer platform Thirdweb announced on social media that on November 21 at 10:00 AM Beijing time, a security vulnerability was discovered in commonly used open-source libraries in the Web3 industry. This will affect various smart contracts in the Web3 ecosystem, including some of Thirdweb's pre-built smart contracts.According to the investigation so far, the vulnerability has not been exploited in any ThirdWeb smart contracts. However, smart contract owners must take mitigation measures for certain pre-built contracts created on ThirdWeb before 11:00 AM Beijing time on November 23. Affected pre-built contracts include but are not limited to DropERC20, ERC721, ERC1155 (all versions), and AirdropERC20.

ChainCatcher news, Arbitrum ecosystem DEX GMBL.COMPUTER explained the details of today's signature key leak incident on platform X, stating that someone was able to forge a "call" and obtain a signature from its server, then pass that signature to the contract, extracting nearly 500 ETH (approximately $815,000 at current prices) worth of GMBL from the contract.GMBL.COMPUTER stated that this is not a contract vulnerability, and the team has identified the root cause of the issue. The key leak was an off-chain action, and the team has gathered all the information about the attacker and will begin to recover the funds. They will offer a bug bounty, and if the funds are returned, no legal action will be taken.

ChainCatcher news, blockchain technology company ConsenSys has publicly released the "Diligence Fuzzing" tool for smart contract testing.It is reported that the new tool generates "random and invalid data points" to identify vulnerabilities in contracts before they are deployed. This new tool was previously available only in a closed testing version, requiring developers to obtain access approval. As of August 1, this approval process is no longer necessary.

ChainCatcher news, DefiLlama founder 0xngmi tweeted that the NFT market Foundation has a vulnerability in its NFT contract that allows the Foundation team to destroy almost all NFTs minted on its platform. The Foundation's collection contract uses a proxy forwarding model to save on deployment gas, which means that all collections call a single contract to use its code without issue, and the Foundation's collection has a feature that allows creators to destroy it without an NFT. Currently, the contract ownership of the Foundation team is held by 2 out of 6 multi-signatures.0xngmi stated that a fix could be implemented by minting 1 NFT in the implementation contract and then transferring it to a burn address to remove this backdoor, but he disclosed this issue to the Foundation 6 months ago and it has not been fixed to date. (Source link)

ChainCatcher news, Coinbase executive Conor Grogan tweeted that he inserted a live Ethereum smart contract into ChatGPT-4, and the AI instantly found security vulnerabilities, even demonstrating how to exploit these vulnerabilities for attacks.Conor Grogan added that the contract was indeed exploited by hackers in 2018, and he also revealed that he tried Euler's smart contract, but it was too long for ChatGPT-4 to process. Conor Grogan believes that AI will ultimately make smart contracts safer and easier to build. (source link)

Sifchain, a full-chain DEX developed based on the Cosmos SDK, announced on Twitter that it has paused network maintenance, upgrades, and operations. It stated that after the on-chain upgrade activated leveraged trading, there were unusual activities involving increased user liquidity and asset removal. However, the impact of this vulnerability was quickly controlled, and many users who gained additional assets expressed a desire to return the funds.It is reported that the engineering team has currently identified a repair and forward roadmap for re-enabling the network and DEX, and testing is underway. Additionally, the Engineering team is analyzing transactions and wallets related to this situation. (Source link)

Chain Catcher news reports that the NFT contract vulnerability of the Rug Pull Finder project, which specifically alerts to risks in the NFT space, has been exploited. During the free minting phase, two addresses took advantage of a technical flaw in the project, stealing 450 NFTs from a possible 1221 NFTs, which were originally restricted to one mint per address.Shortly after the exploit, the team offered a transaction to one of the involved parties, paying them a bounty of 2.5 ETH to recover 330 NFTs, which was accepted. (Cointelegraph)